Limiting the number of connections
To protect against brute force (password guessing) attacks, you can limit the number of connections to port 22 from a single IP address to a few times per minute, after which connection attempts from that IP will be blocked.
## Создание цепочки правил sshguard
# Максимум 2 новых запроса в минуту для одного ip
/sbin/iptables -N sshguard
# Вкл. лог по желанию
#/sbin/iptables -A sshguard -m state --state NEW -m recent --name SSH --rcheck --seconds 60 --hitcount 2 -j LOG --log-prefix "SSH-shield: "
/sbin/iptables -A sshguard -m state --state NEW -m recent --name SSH --update --seconds 60 --hitcount 2 -j DROP
/sbin/iptables -A sshguard -m state --state NEW -m recent --name SSH --set -j ACCEPT
/sbin/iptables -A sshguard -j ACCEPT
## Применение для трафика ssh цепочку sshguard
/sbin/iptables -A INPUT -p tcp --dport 22 -j sshguard
recent is a kernel module (Core Netfilter Configuration) that allows the creation of dynamic IP address lists. The module supports several options:
-
--name name: The name of the list the command operates on. By default, the list name is DEFAULT.
-
--rcheck: This option checks whether the source address of the packet is present in the list. If the address is not found in the list, it returns false.
-
--update: This option checks whether the source address of the packet is present in the list. If the address exists, the corresponding record is updated. If the address is not found in the list, it returns false.
-
--hitcount hits: A counter that returns true if the address is present in the list and the number of accepted packets from that address is greater than or equal to the specified value. Used together with rcheck or update.
-
--seconds seconds: Defines the period (from the moment the address was added to the list) during which the address can remain in the list.
-
--set: Used to add the source address of the packet to the list. If the address already exists in the list, the record will be updated.
-
--remove: Removes the address from the list. If the address is not found, it returns false.
Options can be used with inversion (!).
A simple iptables rule that helps avoid keeping ports open unnecessarily.
Example for SSH access, although as you can see, it can be used in any way you like.
The essence of the rule is simple: to open access to the shell, you first need to connect to port 1500:
for example, using telnet:
telnet myserver 1500
or via a browser:
http://192.168.0.100:1500
Consequently, if you connect to port 1499, the port will close.
iptables -N sshguard # Если адрес в списке, то подключение разрешено iptables -A sshguard -m state --state NEW -m recent --rcheck --name SSH -j ACCEPT # Разрешить пакеты для уже установленных соединений iptables -A sshguard -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A sshguard -j DROP # Заносит адрес в список #iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 1500 -j LOG --log-prefix "SSH-open: " iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 1500 -m recent --name SSH --set -j DROP # Удаляет адрес из списка iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 1499 -m recent --name SSH --remove -j DROP # Применение для трафика ssh цепочку sshguard iptables -A INPUT -p tcp --dport 22 -j sshguard
Opening the SSH port for a specified duration
Another example demonstrates how to open the SSH port for a specific IP address for a set amount of time.
## определяем цепочку для SSH трафика
iptables -N sshguard
iptables -F sshguard
# Разрешить подключение если ip есть в списке и последнее подключение осуществлялось не позднее 108000 секунд (30 часов)
iptables -A sshguard -m state --state NEW -m recent --update --seconds 108000 --name SSH -j ACCEPT
# Разрешить пакеты для уже установленных соединений
iptables -A sshguard -m state --state ESTABLISHED,RELATED -j ACCEPT
# Заблокировать если нет в списке
iptables -A sshguard -j DROP
## Открытие SSH
iptables -A INPUT -m state --state NEW -p tcp --dport 222 -m recent --name SSH --set
## Фильтрация ssh трафика через цепочку sshguard
iptables -A INPUT -p tcp --dport 22 -j sshguard
Now, to gain SSH access, you first need to connect to port 222, for example like this:
ssh user@server.name -p 222
After that, access to port 22 for your IP will be allowed for the specified duration. Each new SSH connection will extend this time. If you do not want the time to be extended, replace --update --seconds 108000 with --rcheck.