On Tue, 25 May 2010, David wrote:
> I would like to use CentOS for all. I've a transparent firewall (CentOS
> + iptables) and I want to use it as a filter. I've been using iptables
> on the server machine (not in transparent firewall), and I want to get
> the job done by the firewall. Is it possible if my firewall to do this
> task? while being attacked is different computer?
sort of, yes. after some investigation and thought, i decided to protect
my ssh servers with rate-limiting, using iptables.
rate-limiting doesn't care whether a login succeeded or failed, it just
detects repeated attempts to connect from the same source address to the
same destination port, and blocks any past the first two in a rolling
60-second window (both parameters are of course configurable). this makes
it suitable for use on the firewall rather than the endpoint, and i
suspect it can be extended to IMAP and similar services (though mail
clients that wish to continually make new connections rather than keeping
existing ones open and reusing them will run into problems).
for sshd, analysis of last week's logs shows that the number of connection
attempts rejected this way each day varies from 2,200 to 82,000, while the
number of failed logins on sshd varies daily from 2 to 25 - so you can see
that this is somewhere between 99% and 99.997% effective at preventing
people from getting as far as a password-guessing attack. server load has
*substantially* decreased.
if this is of interest to you i wrote it the details up at
http://www.teaparty.net/technotes/ssh-rate-limiting.html .
--
Tom Yates - http://www.teaparty.net
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
