{"id":3,"date":"2005-02-18T20:16:37","date_gmt":"2005-02-18T19:16:37","guid":{"rendered":"http:\/\/blog.blackdown.de\/?p=3"},"modified":"2016-10-29T03:51:03","modified_gmt":"2016-10-29T01:51:03","slug":"mitigating-ssh-brute-force-attacks-with-ipt_recent","status":"publish","type":"post","link":"https:\/\/blackdown.de\/articles\/mitigating-ssh-brute-force-attacks-with-ipt_recent\/","title":{"rendered":"Mitigating SSH Brute Force Attacks with ipt_recent"},"content":{"rendered":"

As my SSH<\/a> server only accepts public key based authentication, I’m not really worried about brute force password attacks. But these scans tend to clobber my auth.log<\/code>. So after some discussion with Andrew Pollock<\/a>, I’ve written a few custom actions for my shorewall<\/a> setup. They use the ipt_recent<\/a> module which allows to track seen IP addresses and match against them using some criteria.<\/p>\n

The Limit<\/a><\/code> action can be used to limit accepted connections per IP and timeframe. The hardcoded limit currently is 6 connections per 60 seconds. If an IP tries to connect more often, the attempts will be DROPed.<\/p>\n

The Whitelist<\/a><\/code> action provides some simple port-knocking whitelist. If you know the WHITELIST_PORT<\/code> and can lift the limits imposed by the Limit<\/a><\/code> action for your IP and 60 seconds by connecting to that port.<\/p>\n

Here’s how you can integrate those two actions:<\/p>\n