Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #175570

Re: ssh doesn't work.

Show all headers | View raw

	Hi.

On Thu, 8 Dec 2016 15:37:45 +0000
Darac Marjal <mailinglist@darac.org.uk> wrote:

> On Thu, Dec 08, 2016 at 01:18:38AM +0300, Reco wrote:
> >On Wed, 7 Dec 2016 15:54:46 -0500
> >Henning Follmann <hfollmann@itcfollmann.com> wrote:
> >
> >> On Wed, Dec 07, 2016 at 11:28:53PM +0300, Reco wrote:
> >> > 	Hi.
> >> >
> >> > On Wed, 7 Dec 2016 21:14:51 +0200
> >> > Antti Talsta <atalsta@nothingtosee.org> wrote:
> >> >
> >> > > On Wed, Dec 07, 2016 at 01:49:34PM -0500, Greg Wooledge wrote:
> >> > >
> >> > > > Changing the port at least decreases the number of brute force attacks
> >> > > > against you, which saves resources (bandwidth, CPU) that are otherwise
> >> > > > wasted by the attackers.
> >> > >
> >> > > How about fail2ban for that?
> >> >
> >> > How fail2ban can help against an army of bots trying one single
> >> > password per bot?
> >> >
> >> That actually works well. Usually it's multiple attempts from one ip.
> >> fail2ban catches exactly that. And then blacklists that ip.
> >
> >Probably it is so. It's been awhile since I ran publicly accessible
> >sshd on port 22 with password authentication enabled.
> >
> >Personally I prefer a bunch of simple iptables rules to fail2ban
> >though. After all, why bother running a userspace tool, if you can
> >force the kernel itself to do the job?
> 
> Could you share with the group what "simple iptables rules" you use? I 
> presume that iptables, by itself, can't replicate the idea of "block 
> after X failures in Y minutes", but presumably you're using some kind of 
> rate limiting, instead?

Sure. It's in archives somewhere already, but:

iptables -A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW \
-m hashlimit --hashlimit-upto 1/hour --hashlimit-burst 8 \
--hashlimit-mode srcip --hashlimit-name ssh \
--hashlimit-htable-expire 65536 -m comment --comment "HTTPS Blocker" \
 -j ACCEPT

iptables -A INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN \
-m comment --comment "HTTPS Blocker" -j DROP

Back in the day I was not that lazy for building kernel modules I used
TARPIT instead of DROP.


PS From the previous discussion of this very topic I was pointed that
such iptables configuration is unsuitable for certain 'Modern Desktop
Environment'. Therefore this iptables configuration should be used on
'understand what I'm doing' basis.

Reco

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

ssh doesn't work. EenyMeenyMinyMoa <eenymeenyminymoa@gmail.com> - 2016-12-06 05:40 +0100
  Re: ssh doesn't work. Andy Smith <andy@strugglers.net> - 2016-12-06 07:30 +0100
    Re: ssh doesn't work. EenyMeenyMinyMoa <eenymeenyminymoa@gmail.com> - 2016-12-07 16:30 +0100
      Re: ssh doesn't work. Henning Follmann <hfollmann@itcfollmann.com> - 2016-12-07 17:00 +0100
        Re: ssh doesn't work. EenyMeenyMinyMoa <eenymeenyminymoa@gmail.com> - 2016-12-07 18:40 +0100
          Re: ssh doesn't work. Greg Wooledge <wooledg@eeg.ccf.org> - 2016-12-07 19:00 +0100
            Re: ssh doesn't work. EenyMeenyMinyMoa <eenymeenyminymoa@gmail.com> - 2016-12-08 05:20 +0100
          Re: ssh doesn't work. Henning Follmann <hfollmann@itcfollmann.com> - 2016-12-07 19:20 +0100
            Re: ssh doesn't work. Greg Wooledge <wooledg@eeg.ccf.org> - 2016-12-07 19:50 +0100
              Re: ssh doesn't work. Henning Follmann <hfollmann@itcfollmann.com> - 2016-12-07 20:20 +0100
              Re: ssh doesn't work. Antti Talsta <atalsta@nothingtosee.org> - 2016-12-07 20:30 +0100
                Re: ssh doesn't work. Reco <recoverym4n@gmail.com> - 2016-12-07 21:30 +0100
                Re: ssh doesn't work. Henning Follmann <hfollmann@itcfollmann.com> - 2016-12-07 21:50 +0100
                Re: ssh doesn't work. Reco <recoverym4n@gmail.com> - 2016-12-07 23:20 +0100
                Re: ssh doesn't work. Darac Marjal <mailinglist@darac.org.uk> - 2016-12-08 16:40 +0100
                Re: ssh doesn't work. Reco <recoverym4n@gmail.com> - 2016-12-08 18:00 +0100
                Re: ssh doesn't work. Antti Talsta <atalsta@nothingtosee.org> - 2016-12-07 21:50 +0100
                Re: ssh doesn't work. Reco <recoverym4n@gmail.com> - 2016-12-07 23:20 +0100
              Re: ssh doesn't work. Brian <ad44@cityscape.co.uk> - 2016-12-07 21:30 +0100
                Re: ssh doesn't work. EenyMeenyMinyMoa <eenymeenyminymoa@gmail.com> - 2016-12-08 05:20 +0100
                Re: ssh doesn't work. Lisi Reisz <lisi.reisz@gmail.com> - 2016-12-08 11:10 +0100
                Re: ssh doesn't work. EenyMeenyMinyMoa <eenymeenyminymoa@gmail.com> - 2016-12-10 06:00 +0100
                Re: ssh doesn't work. Joe <joe@jretrading.com> - 2016-12-10 10:10 +0100
                Re: ssh doesn't work. Richard Hector <richard@walnut.gen.nz> - 2016-12-11 08:40 +0100
            Re: ssh doesn't work. EenyMeenyMinyMoa <eenymeenyminymoa@gmail.com> - 2016-12-08 06:50 +0100
              Re: ssh doesn't work. emetib <chadbrabec@gmail.com> - 2016-12-08 09:00 +0100
                Re: ssh doesn't work. Henning Follmann <hfollmann@itcfollmann.com> - 2016-12-08 13:50 +0100
          Re: ssh doesn't work. emetib <chadbrabec@gmail.com> - 2016-12-07 20:20 +0100

csiph-web