Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #3049

Re: Blocking IP addresses from specific countries

Show all headers | View raw

On Mon, 28 Jul 2014, in the Usenet newsgroup comp.os.linux.networking, in
article <8jriabxq6f.ln2@goaway.wombat.san-francisco.ca.us>, Keith Keller wrote:

>Moe Trin <ibuprofin@painkiller.example.tld.invalid> wrote:

>> If you really need to allow SSH access from "the world", you can
>> look at a log-reader tool such as "BlockHosts", "Fail2Ban",
>> "blocksshd" or "BruteForceBlocker", to TEMPORARILY block (10 minutes
>> is a good number) specific hosts that tried and failed to connect.

>A newish tool in this area is sshguard, which adds appropriate
>iptables rules, and also has options for automatically expiring these
>new iptables rules (which is the default configuration).

========================
sshguard     http://www.sshguard.net/    (still at 1.5 6/13/12, 1/19/13,
7/11/13, 1/16/14 and 7/28/14)
log reader for Linux, *BSD, AIX, MacOS, Solaris, etc.  Uses firewall
rules if possible, tcp_wrappers if not.   Available in .rpms and .debs
as well as a tarball.
1.5       Feb 2011       1.4       Aug 2009       1.3       Oct 2008
1.2       Sep 2008       1.1       Jul 2008       1.0       May 2007
0.91      Mar 2007       0.9       Feb 2007  - first public release
First block defaults to 7 minutes - doubles per repeated blocks. Can be
permanent, has whitelist.  Doesn't block if attempts are slow enough (20
minutes default).
========================

The reason I didn't mention it was the lack of revision activity.

Mentioned, I avoid most of the problems because the firewall only
allows connections to 22/tcp from ~1500 addresses.  I used to modify
the rules when I went on travel, but for the past ten years have used
the port-knocking to open a temporary hole in the firewall. I make it
harder because the username is intentionally obscure, never mind not
being one of the mail names I use.

        Old guy

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Blocking IP addresses from specific countries Clark Smith <noaddress@nowhere.net> - 2014-07-27 20:14 +0000
  Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-28 02:32 +0000
  Re: Blocking IP addresses from specific countries Jorgen Grahn <grahn+nntp@snipabacken.se> - 2014-07-28 07:13 +0000
  Re: Blocking IP addresses from specific countries Andrzej Adam Filip <anfi@onet.eu> - 2014-07-28 09:17 +0200
  Re: Blocking IP addresses from specific countries Joe Beanfish <joebeanfish@nospam.duh> - 2014-07-28 13:17 +0000
    Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-28 17:51 +0000
      Re: Blocking IP addresses from specific countries Aleksandar Kuktin <akuktin@gmail.com> - 2014-07-28 19:36 +0000
        Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-29 01:59 +0000
      Re: Blocking IP addresses from specific countries Keith Keller <kkeller-usenet@wombat.san-francisco.ca.us> - 2014-07-28 14:23 -0700
        Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-29 01:57 +0000
      Re: Blocking IP addresses from specific countries Joe Beanfish <joebeanfish@nospam.duh> - 2014-07-29 13:16 +0000
  Re: Blocking IP addresses from specific countries Roger Blake <rogblake@iname.invalid> - 2014-07-28 20:55 +0000
    Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-29 02:00 +0000

csiph-web