[plug] firewalling ssh

[David Lloyd]

And...

> iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent \
>   --set
> 
> iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent \
>   --update --seconds 60 --hitcount 4 -j DROP
> 
> This block anything after the 3rd hit from an IP within 60 seconds.
> 

  * http://www.debian-administration.org/articles/187

...which explains what's happening :)

DSL