Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #163148

Re: DenyHosts

Show all headers | View raw

	Hi.

On Sat, 16 Jan 2016 07:35:54 -0500
Steve Matzura <number6@noisynotes.com> wrote:
> >But with conjunction with the previous one it implements the following
> >policy:
> >
> >- anyone can connect up to 16 times via ssh.
> >- anyone exceeding the connection limit is tarpitted, and must wait
> >for an hour to try again.
> 
> That seems more than fair. Nobody using the system correctly should
> ever break this rule under normal circumstances and/or conditions.

Indeed. That's why I use exactly these rules for my hosts ;)


> >> How do these commands function to lock out specific addresses or
> >> address ranges?
> >
> >The current implementation works with single source IPs.
> >Modifying the rules to work with IP ranges is an exercise left for the
> >reader :)
> 
> By "the current implementation," do you mean before or after I used
> the commands you gave? There is nothing in either of these two
> complex-side command sets that specify a single address.

I meant these two netfilter rules.
There's no need to specify nor source nor destination IPs in these
rules, the whole idea of these rules is to apply to anyone.
It's sufficient to store a hash of a source IP from previous connection
attempts as it's used for counting them.


It's possible to limit this policy to a single IP (or a subnet in this
example):

iptables -I INPUT -p tcp --dport 22 -s 59.46.71.0/24 \
	-m conntrack --ctstate NEW \
	-m hashlimit --hashlimit 1/hour --hashlimit-burst 16 \
	--hashlimit-mode srcip --hashlimit-name ssh \
	--hashlimit-htable-expire 60000 -j ACCEPT

iptables -I INPUT -p tcp --dport 22 -s 59.46.71.0/24 \
	--tcp-flags SYN,RST,ACK SYN -j DROP


But then again - why bother? This set of rules should not interfere
with normal user activity anyway.

Reco

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

DenyHosts Steve Matzura <sm@noisynotes.com> - 2016-01-15 22:40 +0100
  Re: DenyHosts Sven Arvidsson <sa@whiz.se> - 2016-01-15 22:50 +0100
  Re: DenyHosts "Cláudio E. Elicker" <elicker@gmail.com> - 2016-01-15 23:10 +0100
  Re: DenyHosts Reco <recoverym4n@gmail.com> - 2016-01-16 00:00 +0100
    Re: DenyHosts Steve Matzura <sm@noisynotes.com> - 2016-01-16 05:50 +0100
      Re: DenyHosts David <bouncingcats@gmail.com> - 2016-01-16 06:50 +0100
        Re: DenyHosts Chris Bannister <cbannister@slingshot.co.nz> - 2016-01-17 06:50 +0100
    Re: DenyHosts Steve Matzura <sm@noisynotes.com> - 2016-01-16 06:00 +0100
    Re: DenyHosts Steve Matzura <number6@noisynotes.com> - 2016-01-16 07:10 +0100
      Re: DenyHosts Reco <recoverym4n@gmail.com> - 2016-01-16 11:00 +0100
        Re: DenyHosts Steve Matzura <number6@noisynotes.com> - 2016-01-16 14:00 +0100
          Re: DenyHosts Reco <recoverym4n@gmail.com> - 2016-01-16 14:20 +0100
            Re: DenyHosts Steve Matzura <sm@noisynotes.com> - 2016-01-16 19:10 +0100
              Re: DenyHosts Reco <recoverym4n@gmail.com> - 2016-01-16 22:00 +0100
                Re: DenyHosts Steve Matzura <number6@noisynotes.com> - 2016-01-16 22:30 +0100
        Re: DenyHosts Christian Seiler <christian@iwakd.de> - 2016-01-17 14:10 +0100
          Re: DenyHosts Moreanu Robert - Nicolae <robertmoreanu@gmail.com> - 2016-01-17 14:40 +0100
            Re: DenyHosts Bob Holtzman <holtzm@cox.net> - 2016-01-17 22:50 +0100
          Re: DenyHosts Igor Cicimov <icicimov@gmail.com> - 2016-01-17 14:40 +0100
  Re: DenyHosts Steve Matzura <sm@noisynotes.com> - 2016-01-16 18:10 +0100
    Re: DenyHosts Reco <recoverym4n@gmail.com> - 2016-01-16 18:20 +0100
      Re: DenyHosts Steve Matzura <number6@noisynotes.com> - 2016-01-16 19:10 +0100
        Re: DenyHosts Reco <recoverym4n@gmail.com> - 2016-01-16 21:50 +0100
          Re: DenyHosts Steve Matzura <number6@noisynotes.com> - 2016-01-16 22:40 +0100

csiph-web