Crmgo Blog

iptables-Schutz vor SSH-Passwort-Brute-Force

← Blog

renisans

iptables-Schutz vor SSH-Passwort-Brute-Force

Option 1. Limiting connections. iptables -A INPUT -p tcp –dport 22 -m recent –name ssh –update –seconds 3600 –hitcount 5 -j REJECT iptables -A INPUT -p tcp –dport 22 -m recent –name ssh –set -j ACCEPT The rule allows 5 connections…

iptables-Schutz vor SSH-Passwort-Brute-Force

Option 1. Limiting connections.

iptables -A INPUT -p tcp –dport 22 -m recent –name ssh –update –seconds 3600 –hitcount 5 -j REJECT iptables -A INPUT -p tcp –dport 22 -m recent –name ssh –set -j ACCEPT

The rule allows 5 connections per hour and blocks if the limit is exceeded. In principle, this is already protection against brute force, as it will be tedious to guess the password with only 5 connections per hour.

Option 2. Port scanner deception + connection limiting.

iptables -A INPUT -p tcp –dport 22 -m recent –name ssh –update –seconds 3600 –hitcount 8 -j REJECT iptables -A INPUT -p tcp –dport 22 -m recent –name ssh –set iptables -A INPUT -p tcp –dport 22 -m recent –name ssh ! –rcheck –seconds 15 –hitcount 2 -j REJECT iptables -A INPUT -p tcp –dport 22 -j ACCEPT

Sequence of actions:
1. Attempt to connect to port 22 (normal connection or port scan)
2. The connection is dropped and 15 seconds are given for login
3. If logged in successfully within 15 seconds – access is granted; if not – it is rejected and another 15 seconds are given.
4. If there are 8 failures in an hour, it blocks until the start of the next hour after the first failure.

Advantages of this feature: the port scanner does not immediately see that port 22 is open. Also, brute-forcing will not work if they realize it is open – 8 attempts are too few for brute force.

Disadvantages: if you accidentally ban yourself – wait an hour).

Hinweis: Dieser Beitrag kann KI-unterstützt erstellt und anschließend redaktionell geprüft worden sein. Verantwortlich: Dmytro Lomaka, Kaltenkirchen.