Path: csiph.com!weretis.net!feeder6.news.weretis.net!feeder.usenetexpress.com!feeder-in1.iad1.usenetexpress.com!border1.nntp.dca1.giganews.com!nntp.giganews.com!buffer1.nntp.dca1.giganews.com!buffer2.nntp.dca1.giganews.com!news.giganews.com.POSTED!not-for-mail NNTP-Posting-Date: Mon, 27 Aug 2018 10:22:43 -0500 From: Scott Hemphill Newsgroups: comp.os.linux.networking Subject: Re: Need help with iptables and ftp References: Reply-To: hemphill@alumni.caltech.edu Date: Mon, 27 Aug 2018 11:22:43 -0400 Message-ID: <877ekb96m4.fsf@hemphills.net> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) Cancel-Lock: sha1:6azHg6IieYbSyBJK31MXvlqYTMI= MIME-Version: 1.0 Content-Type: text/plain Lines: 37 X-Usenet-Provider: http://www.giganews.com X-Trace: sv3-ACT5lLQn/+0u6lvJ7/QjnZpDkBcfoQvcM8Wj21TdNZIPEuv3PSoY7tT++A6GE5sxzyf33BPtvl/vWkP!0o7EMMQA6HXx8wu++r83FAItp4VXHW/XVdu6iGsKdxLXPy+f77eoLCw= X-Complaints-To: abuse@giganews.com X-DMCA-Notifications: http://www.giganews.com/info/dmca.html X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly X-Postfilter: 1.3.40 X-Original-Bytes: 2670 Xref: csiph.com comp.os.linux.networking:4206 "David W. Hodgins" writes: [snip] > I've intentionally set sshd to run on a high number port to avoid having > script kiddies fill my logs with failed attempts (It's set to allow > login with a key only, not a password). Alternatively, or in addition to this, you might want to run knockd. You can keep all ports closed, but when a particular sequence of ports is accessed, you can dynamically open a particular port for your ssh connection. The default configuration file looks like: ------------------------------------------------------------------------ [OPTIONS] UseSyslog [opencloseSSH] sequence = 2222:udp,3333:tcp,4444:udp seq_timeout = 15 tcpflags = syn,ack start_command = /sbin/iptables -A INPUT -s %IP% -p tcp --dport ssh -j ACCEPT cmd_timeout = 10 stop_command = /sbin/iptables -D INPUT -s %IP% -p tcp --dport ssh -j ACCEPT ------------------------------------------------------------------------ In my case, I have separate open and close sequences, with knockd calling a script to run iptables with commands for port forwarding. I then use the PortKnock app on my iPhone when I want to ssh in. Scott -- Scott Hemphill hemphill@alumni.caltech.edu "This isn't flying. This is falling, with style." -- Buzz Lightyear