Stopping SSH brute force attacks using iptables

Duffy — Thu, 09 Apr 2009 11:08:52 +0000

If your running a SSH server on the default port(22) you've probably noticed a lot of failed login attempts cause due to brute force attacks

Adding the following to your IP tables will only allow 3 connections at once from any IP if it goes above 3 then that IP is locked out for 3minutes. At this stage the bot running the attack will either give up as its getting no reply from the SSH server or it will keep trying until it finishes its wordlist

iptables -I INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource

iptables -I INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 180 --hitcount 4 --name DEFAULT --rsource -j DROP

Tuts4Tech » wordlist

Stopping SSH brute force attacks using iptables