hitcount miss

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi all

In my ruleset  on my hosted box, I have the following ruleset.

$IPT -N SSH_Brute_Force
$IPT -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --name SSH --set --rsource -j SSH_Brute_Force
$IPT -A SSH_Brute_Force -s $myhomeip -j ACCEPT
$IPT -A SSH_Brute_Force -m recent ! --rcheck --seconds 60 --hitcount 3 --name SSH --rsource -j ACCEPT
$IPT -A SSH_Brute_Force -j LOG --log-prefix "SSH Brute Force Attempt:  "
$IPT -A SSH_Brute_Force -p tcp -j DROP

I thought this would work.

But I cant SSH from any other location, other than from the IP $myhomeip.

What I was looking for, was that when I go on holiday (Thailand here I come). I can still SSH from anywhere else in the world.
But obviously, for the bruteforcers out there, who try and make multiple connections, they will fall to DROP, based on their hitcount.

If anyone could assist, I would be most grateful


[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux