Re: SSH Brute force attacks

["Taylor, Grant" <gtaylor@riverviewtech.net>]

> I get the error Brent gets above, but I do have the recent module:

> ipt_recent v0.3.1: Stephen Frost <sfrost@snowman.net>.
> http://snowman.net/projects/ipt_recent/
> 
> and "--hitcount" is referenced in the help:
> 
> --hitcount hits             For check and update commands above.
>                                 Specifies that the match will only occur
> if source address seen hits times.
> 
> FWIW, I'm using iptables 1.2.11 in Fedora Core 3.

Hmm, you may need / want to update your iptables and apply the most recent p-o-m patch for the recent match extension.  Here is what I get as output when I do "iptables -m recent -h":

recent v1.3.1-20050422 options:
[!] --set                       Add source address to list, always matches.
[!] --rcheck                    Match if source address in list.
[!] --update                    Match if source address in list, also update last-seen time.
[!] --remove                    Match if source address in list, also removes that address from list.
    --seconds seconds           For check and update commands above.
                                Specifies that the match will only occur if source address last seen within
                                the last 'seconds' seconds.
    --hitcount hits             For check and update commands above.
                                Specifies that the match will only occur if source address seen hits times.
                                May be used in conjunction with the seconds option.
    --rttl                      For check and update commands above.
                                Specifies that the match will only occur if the source address and the TTL
                                match between this packet and the one which was set.
                                Useful if you have problems with people spoofing their source address in order
                                to DoS you via this module.
    --name name                 Name of the recent list to be used.  DEFAULT used if none given.
    --rsource                   Match/Save the source address of each packet in the recent list table (default).
    --rdest                     Match/Save the destination address of each packet in the recent list table.
ipt_recent v0.3.1: Stephen Frost <sfrost@snowman.net>.  http://snowman.net/projects/ipt_recent/




Grant. . . .