Re: crazy hackers and logwatch

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, 2005-08-09 at 09:39 -0600, Kevin Fenzi wrote:
> A better rule (IMHO), I use: 
> 
> $IPTABLES -A INPUT -m hashlimit -m tcp -p tcp --dport 22 --hashlimit 1/min --hashlimit-mode srcip --hashlimit-name ssh -m state --state NEW -j ACCEPT
> 
> This has the advantage of only blocking the offending IP if they go
> over 1/min, but letting all other ip's still have access until they go
> over the limit.

I've used similar rules for some time now and they've proven very
effective. The only problem I've run into is with subversion over SSH,
it generates a lot of  short connections sometimes (for example when
browsing a repository) and can look like an attack to this kind of
block. For that reason I am interested in testing DENYHOSTS. 

-- 
Brian Gaynor
www.pmccorp.com
FC4/Linux on DELL Inspiron 5160 3.0Ghz 
canis 08:55:20 up 26 min, 1 
user, load average: 0.27, 0.22, 


-- 
fedora-test-list mailing list
fedora-test-list@xxxxxxxxxx
To unsubscribe: 
http://www.redhat.com/mailman/listinfo/fedora-test-list

[Index of Archives]     [Fedora Desktop]     [Fedora SELinux]     [Photo Sharing]     [Yosemite Forum]     [KDE Users]