Crmgo Blog

iptables protection against SSH password brute-force

← Blog

renisans

iptables protection against SSH password brute-force

Option 1. Limiting connections. iptables -A INPUT -p tcp --dport 22 -m recent --name ssh --update --seconds 3600 --hitcount 5 -j REJECT iptables -A INPUT -p tcp --dport 22 -m recent --name ssh --set -j ACCEPT The rule allows 5 connections...

iptables protection against SSH password brute-force

Option 1. Limiting connections.

iptables -A INPUT -p tcp –dport 22 -m recent –name ssh –update –seconds 3600 –hitcount 5 -j REJECT iptables -A INPUT -p tcp –dport 22 -m recent –name ssh –set -j ACCEPT

The rule allows 5 connections per hour and blocks if the limit is exceeded. In principle, this is already protection against brute force, since it will be tedious to guess the password with only 5 connections per hour.

Option 2. Port scanner deception + connection limiting.

iptables -A INPUT -p tcp –dport 22 -m recent –name ssh –update –seconds 3600 –hitcount 8 -j REJECT iptables -A INPUT -p tcp –dport 22 -m recent –name ssh –set iptables -A INPUT -p tcp –dport 22 -m recent –name ssh ! –rcheck –seconds 15 –hitcount 2 -j REJECT iptables -A INPUT -p tcp –dport 22 -j ACCEPT

Sequence of actions:
1. Attempt to connect to port 22 (normal connection or port scan)
2. The connection is dropped, and 15 seconds are given for login
3. If you log in successfully within 15 seconds – access is granted; if you fail to do so – it is rejected, and another 15 seconds are given.
4. If there are 8 failures in an hour, it blocks until the start of the next hour after the first failure.

Advantages of this feature: the port scanner does not immediately realize that port 22 is open. Also, brute-forcing will not work; even if they realize it is open, 8 attempts are too few for brute force.

Disadvantages: if you accidentally ban yourself – you have to wait an hour.)

Note: This post may be AI-assisted and then human-edited. Editorial responsibility: Dmytro Lomaka, Kaltenkirchen.