On Tue, Apr 15, 2008 at 10:29:16AM -0700, Tim Alberts wrote:
Ned Slider wrote:
Tim Alberts wrote:
So I setup ssh on a server so I could do some work from home and I think the second I opened it every sorry monkey from around the world has been trying every account name imaginable to get into the system.
What's a good way to deal with this?
The Wiki has an article here on just this:
I've been experimenting with the iptables filtering with the recent module, but I have not yet had success. I do have my default policy to reject with icmp and I've read the note that the default should be DROP. Is this the problem?
I use the following iptables rules to halt the hammering:
/sbin/iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 -j DROP /sbin/iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
note wrapping of commands.
Chip