[CentOS] Re: Simple IPTABLES Question
Matt
lm7812 at gmail.comWed Aug 20 15:01:02 UTC 2008
- Previous message: [CentOS] Simple IPTABLES Question
- Next message: [CentOS] Re: Simple IPTABLES Question
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
> I added these rules to IPTABLES to slow brute force attacks. > > iptables -A INPUT -p tcp --dport 22 -s my_subnet/24 -j ACCEPT > iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent > --set --name SSH > iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent > --update --seconds 60 --hitcount 5 --rttl --name SSH -j DROP > > I would like log entries when connections are dropped to see that its > working. How do I do that? > > I am guessing I would add this before the drop. > > iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent > --update --seconds 60 --hitcount 5 --rttl --name SSH -j LOG > --log-prefix 'SSH attack: ' That seems to have worked. Another quick question. Would it be better to TARPIT rather then DROP the packets? Matt
- Previous message: [CentOS] Simple IPTABLES Question
- Next message: [CentOS] Re: Simple IPTABLES Question
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
More information about the CentOS mailing list