Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #163125 > unrolled thread

DenyHosts

Started bySteve Matzura <sm@noisynotes.com>
First post2016-01-15 22:40 +0100
Last post2016-01-16 22:40 +0100
Articles 4 on this page of 24 — 11 participants

Back to article view | Back to linux.debian.user

Contents

  DenyHosts Steve Matzura <sm@noisynotes.com> - 2016-01-15 22:40 +0100
    Re: DenyHosts Sven Arvidsson <sa@whiz.se> - 2016-01-15 22:50 +0100
    Re: DenyHosts "Cláudio E. Elicker" <elicker@gmail.com> - 2016-01-15 23:10 +0100
    Re: DenyHosts Reco <recoverym4n@gmail.com> - 2016-01-16 00:00 +0100
      Re: DenyHosts Steve Matzura <sm@noisynotes.com> - 2016-01-16 05:50 +0100
        Re: DenyHosts David <bouncingcats@gmail.com> - 2016-01-16 06:50 +0100
          Re: DenyHosts Chris Bannister <cbannister@slingshot.co.nz> - 2016-01-17 06:50 +0100
      Re: DenyHosts Steve Matzura <sm@noisynotes.com> - 2016-01-16 06:00 +0100
      Re: DenyHosts Steve Matzura <number6@noisynotes.com> - 2016-01-16 07:10 +0100
        Re: DenyHosts Reco <recoverym4n@gmail.com> - 2016-01-16 11:00 +0100
          Re: DenyHosts Steve Matzura <number6@noisynotes.com> - 2016-01-16 14:00 +0100
            Re: DenyHosts Reco <recoverym4n@gmail.com> - 2016-01-16 14:20 +0100
              Re: DenyHosts Steve Matzura <sm@noisynotes.com> - 2016-01-16 19:10 +0100
                Re: DenyHosts Reco <recoverym4n@gmail.com> - 2016-01-16 22:00 +0100
                  Re: DenyHosts Steve Matzura <number6@noisynotes.com> - 2016-01-16 22:30 +0100
          Re: DenyHosts Christian Seiler <christian@iwakd.de> - 2016-01-17 14:10 +0100
            Re: DenyHosts Moreanu Robert - Nicolae <robertmoreanu@gmail.com> - 2016-01-17 14:40 +0100
              Re: DenyHosts Bob Holtzman <holtzm@cox.net> - 2016-01-17 22:50 +0100
            Re: DenyHosts Igor Cicimov <icicimov@gmail.com> - 2016-01-17 14:40 +0100
    Re: DenyHosts Steve Matzura <sm@noisynotes.com> - 2016-01-16 18:10 +0100
      Re: DenyHosts Reco <recoverym4n@gmail.com> - 2016-01-16 18:20 +0100
        Re: DenyHosts Steve Matzura <number6@noisynotes.com> - 2016-01-16 19:10 +0100
          Re: DenyHosts Reco <recoverym4n@gmail.com> - 2016-01-16 21:50 +0100
            Re: DenyHosts Steve Matzura <number6@noisynotes.com> - 2016-01-16 22:40 +0100

Page 2 of 2 — ← Prev page 1 [2]

#163162

FromReco <recoverym4n@gmail.com>
Date2016-01-16 18:20 +0100
Message-ID<qRCG6-7ja-7@gated-at.bofh.it>
In reply to#163161
	Hi.

On Sat, 16 Jan 2016 12:02:57 -0500
Steve Matzura <sm@noisynotes.com> wrote:

> Well, I thought I was doing so well. I discover now that no one,
> including me, can get into my system any more via ssh. Here are the
> current iptables rules:
> 
> *filter
> :INPUT ACCEPT [0:0]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> -A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j DROP
> -A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m
> hashlimit --hashlimit-upto 1/hour --hashlimit-burst 16
> --hashlimit-mode srcip --hashlimit-name ssh --hashlimit-htable-expire
> 60000 -j ACCEPT
> -A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j DROP
> -A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m
> hashlimit --hashlimit-upto 1/hour --hashlimit-burst 16
> --hashlimit-mode srcip --hashlimit-name ssh --hashlimit-htable-expire
> 60000 -j ACCEPT
> -A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j DROP
> -A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m
> hashlimit --hashlimit-upto 1/hour --hashlimit-burst 16
> --hashlimit-mode srcip --hashlimit-name ssh --hashlimit-htable-expire
> 60000 -j ACCEPT
> -A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j DROP
> -A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m
> hashlimit --hashlimit-upto 1/hour --hashlimit-burst 16
> --hashlimit-mode srcip --hashlimit-name ssh --hashlimit-htable-expire
> 60000 -j ACCEPT
> -A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j DROP
> -A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m
> hashlimit --hashlimit-upto 1/hour --hashlimit-burst 16
> --hashlimit-mode srcip --hashlimit-name ssh --hashlimit-htable-expire
> 60000 -j ACCEPT
> -A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j DROP
> -A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j DROP
> -A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m
> hashlimit --hashlimit-upto 1/hour --hashlimit-burst 16
> --hashlimit-mode srcip --hashlimit-name ssh --hashlimit-htable-expire
> 60000 -j ACCEPT
> COMMIT
> 
> What'd I do?
> 

Exactly this:

iptables -F INPUT
iptables -I INPUT -p tcp --dport 22 -m conntrack --ctstate NEW \
	-m hashlimit --hashlimit 1/hour --hashlimit-burst 16 \
	--hashlimit-mode srcip --hashlimit-name ssh \
	--hashlimit-htable-expire 60000 -j ACCEPT
iptables -I INPUT -p tcp --dport 22 --tcp-flags SYN,RST,ACK SYN \
	-j DROP

Note that the order of netfilter rules is top-down (i.e. highest
matching rule plays).
So, first rule on your current list, namely:

-A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j DROP

blocked anyone from using ssh.

Reco

[toc] | [prev] | [next] | [standalone]

#163169

FromSteve Matzura <number6@noisynotes.com>
Date2016-01-16 19:10 +0100
Message-ID<qRDsw-7W1-39@gated-at.bofh.it>
In reply to#163162
On Sat, 16 Jan 2016 20:16:28 +0300, you wrote:

>> What'd I do?
>> 
>
>Exactly this:
>
>iptables -F INPUT
>iptables -I INPUT -p tcp --dport 22 -m conntrack --ctstate NEW \
>	-m hashlimit --hashlimit 1/hour --hashlimit-burst 16 \
>	--hashlimit-mode srcip --hashlimit-name ssh \
>	--hashlimit-htable-expire 60000 -j ACCEPT
>iptables -I INPUT -p tcp --dport 22 --tcp-flags SYN,RST,ACK SYN \
>	-j DROP
>
>Note that the order of netfilter rules is top-down (i.e. highest
>matching rule plays).
>So, first rule on your current list, namely:
>
>-A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j DROP
>
>blocked anyone from using ssh.

I have to tell you, that one *did* look suspicious. Should I remove it
from the list of iptables commands and re-apply the rest of them?


>Reco
>

[toc] | [prev] | [next] | [standalone]

#163177

FromReco <recoverym4n@gmail.com>
Date2016-01-16 21:50 +0100
Message-ID<qRFXk-13Z-5@gated-at.bofh.it>
In reply to#163169
	Hi.

On Sat, 16 Jan 2016 12:46:30 -0500
Steve Matzura <number6@noisynotes.com> wrote:

> On Sat, 16 Jan 2016 20:16:28 +0300, you wrote:
> 
> >> What'd I do?
> >> 
> >
> >Exactly this:
> >
> >iptables -F INPUT
> >iptables -I INPUT -p tcp --dport 22 -m conntrack --ctstate NEW \
> >	-m hashlimit --hashlimit 1/hour --hashlimit-burst 16 \
> >	--hashlimit-mode srcip --hashlimit-name ssh \
> >	--hashlimit-htable-expire 60000 -j ACCEPT
> >iptables -I INPUT -p tcp --dport 22 --tcp-flags SYN,RST,ACK SYN \
> >	-j DROP
> >
> >Note that the order of netfilter rules is top-down (i.e. highest
> >matching rule plays).
> >So, first rule on your current list, namely:
> >
> >-A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j DROP
> >
> >blocked anyone from using ssh.
> 
> I have to tell you, that one *did* look suspicious. Should I remove it
> from the list of iptables commands and re-apply the rest of them?

My bad - I mistook -I (append to head) with -A (append to tail) options.

Correct sequence would be:

iptables -F INPUT
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW \
	-m hashlimit --hashlimit 1/hour --hashlimit-burst 16 \
	--hashlimit-mode srcip --hashlimit-name ssh \
	--hashlimit-htable-expire 60000 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 --tcp-flags SYN,RST,ACK SYN \
	-j DROP

There's no need to remove anything else by hand as -F should remove
everything anyway.

[toc] | [prev] | [next] | [standalone]

#163181

FromSteve Matzura <number6@noisynotes.com>
Date2016-01-16 22:40 +0100
Message-ID<qRGJI-1Au-15@gated-at.bofh.it>
In reply to#163177
Reco:

On Sat, 16 Jan 2016 23:48:54 +0300, you wrote:

>Correct sequence would be:
>
>iptables -F INPUT
>iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW \
>	-m hashlimit --hashlimit 1/hour --hashlimit-burst 16 \
>	--hashlimit-mode srcip --hashlimit-name ssh \
>	--hashlimit-htable-expire 60000 -j ACCEPT
>iptables -A INPUT -p tcp --dport 22 --tcp-flags SYN,RST,ACK SYN \
>	-j DROP

OK, got it perfect now. THANKS!

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web