Re: SSH Brute force attacks

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Charlie Brady wrote:
On Mon, 16 May 2005, [ISO-8859-2] Łukasz Hejnak wrote:
But as for the recent module itself it's a werid one, cause it looks like my iptables don't accept lines like
`iptables -m recent ... -m recent ...`
I mean no matter what I put after the second -m recent, it get's rejected with a 'Unknown arg' msg, altrough the first one works fine :\
Can't figure this one out, anybody has an idea?

Stick with one "-m recent". try this: iptables -A SSH_Brute_Force -m recent --name SSH ! --update --seconds 60 --hitcount 4 -j RETURN

I tried this way but it doesn't work..
I can send more then 4 ssh login requests even within 10 seconds, and it still let's me trough, and of course I'm not trying from a white listed IP.


:\

--
with regards
Łukasz Hejnak


[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux