Prevent SSH attacks

Question

I'm trying to setup iptables rules to only allow 3 attempts by an IP per minute to connect to the servir via SSH, and drop all the connections after to prevent SSH attacks; but it seems i'm doing something wrong!

-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 --name DEFAULT --rsource -j DROP
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

Thanks

Gregory MOUSSAT · Accepted Answer · 2016-11-16T23:32:02.837

10

I think you better have to use fail2ban, because your ipfilter rules also block legitimate connections. fail2ban will only block IPs after failed connections.

Next, a common practice is to ban IPs when they try to connect to port 22, and bind your ssh server to another port. You then face only a couple illegitimate connection per week if your computer is not a well known target.

For the precise question you asked :

iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

edited Nov 16 '16 at 23:32

answered Sep 22 '12 at 16:17

Gregory MOUSSAT

1,737
2
25
48

1

Since the server is a low end vps, I'm trying to keep resource consumption to the minimum while maintaining it as secure as possible. I've already changed the ssh server port. Should I keep those rules (above) to the new port and ban the default one (22)? – MGP Sep 22 '12 at 17:48
Fail2ban is in fact the best solution, even for low VPS – MGP Oct 10 '16 at 13:43

score 7 · Answer 2 · answered Sep 22 '12 at 16:15

7

You can implement what you want with the following 2 rules

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 -j DROP

Note that using -Awhich adds rules to the end of the chain can fall foul of the way that iptables rules are processed i.e. in order so if there is a general DROP or an allow rule before yours is reached than they will never be acted on.

Having said that you may also find fail2ban is a better way of implementing this kind of block.

answered Sep 22 '12 at 16:15

user9517

114,104
20
206
289

When i try to add those rules, i get an error message: iptables: No chain/target/match by that name. – MGP Sep 22 '12 at 16:54
Upvote for fail2ban. – Michael B Sep 22 '12 at 20:47

score 4 · Answer 3 · answered Sep 22 '12 at 16:16

4

You might want to try the LIMIT module.

iptables -A INPUT -p tcp --dport 22 -m limit --limit 3/minute -j ACCEPT

answered Sep 22 '12 at 16:16

Magellan

4,431
3
29
53

Prevent SSH attacks

3 Answers3