From: pauloric@contatogs.com.br
To: netfilter@vger.kernel.org
Subject: Re: sudo /sbin/iptables -v -t filter -A INPUT -p tcp --dport 22 -s 124.225.122.167 -j REJECT does not stop ssh attack
Date: Wed, 13 Oct 2010 15:03:59 -0300 (BRT) [thread overview]
Message-ID: <3469375.485.1286993039640.JavaMail.root@mercurio> (raw)
In-Reply-To: <AANLkTimbhPn+S63HvtvhOMZemGY5tGyzk-b1gjQUg_K5@mail.gmail.com>
Hi
----- Mensagem original -----
> Sorry for the long subject.
>
> But I execute this on my system ...
>
> sudo /sbin/iptables -v -t filter -A INPUT -p tcp --dport 22 -s
> 124.225.122.167 -j REJECT does not stop ssh attack
instead of -A try -I as following:
sudo /sbin/iptables -v -t filter -A INPUT -p tcp --dport 22 -s 124.225.122.167 -j REJECT
Order is important for netfilter...80)
best regards
>
> ... yet message continue to scroll by in my /var/log/secure file
>
> Oct 13 10:33:27 localhost sshd[28222]: Failed password for root from
> 124.225.122.167 port 36421 ssh2
> Oct 13 10:33:27 localhost sshd[28223]: Received disconnect from
> 124.225.122.167: 11: Bye Bye
> Oct 13 10:33:28 localhost sshd[28227]: pam_unix(sshd:auth):
> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
> rhost=124.225.122.167 user=root
> Oct 13 10:33:30 localhost sshd[28227]: Failed password for root from
> 124.225.122.167 port 39871 ssh2
> Oct 13 10:33:30 localhost sshd[28228]: Received disconnect from
> 124.225.122.167: 11: Bye Bye
> Oct 13 10:33:32 localhost sshd[28232]: pam_unix(sshd:auth):
> authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
> rhost=124.225.122.167 user=root
> Oct 13 10:33:34 localhost sshd[28232]: Failed password for root from
> 124.225.122.167 port 43158 ssh2
> Oct 13 10:33:34 localhost sshd[28233]: Received disconnect from
> 124.225.122.167: 11: Bye Bye
>
>
> The messages eventually do stop but I cannot tell if that is because
> iptables stopped it or the attacker just gave up?
>
>
> Is there something wrong with my version of iptables or is my iptables
> command no good?
>
> Thanks
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter"
> in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Paulo Ricardo Bruck - consultor
tel 011 3596-4881 011 3596-4882 cel 011 9235-4327
Contato Global Solutions
http://www.contatogs.com.br
next prev parent reply other threads:[~2010-10-13 18:03 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-10-13 17:59 sudo /sbin/iptables -v -t filter -A INPUT -p tcp --dport 22 -s 124.225.122.167 -j REJECT does not stop ssh attack Red Cricket
2010-10-13 18:03 ` pauloric [this message]
2010-10-13 18:42 ` Jan Engelhardt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3469375.485.1286993039640.JavaMail.root@mercurio \
--to=pauloric@contatogs.com.br \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox