From: Alan Garrison <alang@cronosys.com>
To: netfilter@lists.netfilter.org
Subject: Using the "recent" module to stop ssh/ftp attacks
Date: Wed, 27 Sep 2006 10:28:53 -0400 [thread overview]
Message-ID: <451A8AA5.7010301@cronosys.com> (raw)
I've used the "recent" trick to keep out bulk login attempt,
particularly for some publically accessable FTP sites my company runs:
-A INPUT -p tcp --dport 21 -m state --state NEW -m recent --set
-A INPUT -p tcp --dport 21 -m state --state NEW -m recent --update
--seconds 600 --hitcount 10 -j DROP
-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
It works fine on basic server setups, however I've seen this not work
properly on machines that have ethernet aliases ("eth0", "eth0:1", etc).
Basically it blocks either too soon or just blocks the port
completely even on the first attempt. Does the exact network alias need
to be specified in the rules for these cases, or is there some other
limitation I may not be aware of?
--
Alan Garrison <agarrison@cronosys.com>
(216) 221-4600 x 308
reply other threads:[~2006-09-27 14:28 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=451A8AA5.7010301@cronosys.com \
--to=alang@cronosys.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.