<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
I would also suggest preventing ssh shell access for users with dodgy
passwords or for those who don't need it.<br>
<br>
For example, on most of my Linux boxes, I have ssh access and sudo
rights, but you cannot log in as root via ssh.<br>
<br>
Stuart Midgley wrote:
<blockquote cite="mid685D37AD-BFCB-4D3E-94AD-62BCF607CFB6@ivec.org"
type="cite">rules like these can also assist
<br>
<br>
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m
recent --set --name SSH --rsource
<br>
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j
SSH_WHITELIST
<br>
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m
recent --update --seconds 60 --hitcount 5 --rttl --name SSH --rsource
-j LOG --log-prefix "SSH_brute_force"
<br>
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m
recent --update --seconds 60 --hitcount 5 --rttl --name SSH --rsource
-j DROP
<br>
<br>
which only accept 5 connections in 60s to port 22... if it gets more
than that, it drops the packets. Doesn't work with old versions of
iptables.
<br>
<br>
Stu.
<br>
<br>
<br>
<br>
On 11/09/2006, at 9:34, Shannon Carver wrote:
<br>
<br>
<blockquote type="cite">Interesting! Jason's IPB Monitor sounds like
a good all-in-one package,
<br>
might give it a go tonight for my home Machine.
<br>
<br>
I'm lucky in my current position, that most of the boxes I administer,
I do
<br>
so on my own, so I can limit SSH connections to a set of IP's where
I'll be
<br>
connecting from, or in the case that other users do need SSH access to
the
<br>
system they're usually only connecting from Work connections anyway
(static
<br>
IPs), VPN etc.
<br>
<br>
Thanks for the IPB monitor link!
<br>
</blockquote>
<br>
<br>
--
<br>
Dr Stuart Midgley
<br>
Industry Uptake Program Leader
<br>
iVEC, 'The hub of advanced computing in Western Australia'
<br>
26 Dick Perry Avenue, Technology Park
<br>
Kensington WA 6151
<br>
Australia
<br>
<br>
Phone: +61 8 6436 8545
<br>
Fax: +61 8 6436 8555
<br>
Email: <a class="moz-txt-link-abbreviated" href="mailto:industry@ivec.org">industry@ivec.org</a>
<br>
WWW: <a class="moz-txt-link-freetext" href="http://www.ivec.org">http://www.ivec.org</a>
<br>
<br>
<br>
<br>
_______________________________________________
<br>
PLUG discussion list: <a class="moz-txt-link-abbreviated" href="mailto:plug@plug.org.au">plug@plug.org.au</a>
<br>
<a class="moz-txt-link-freetext" href="http://www.plug.org.au/mailman/listinfo/plug">http://www.plug.org.au/mailman/listinfo/plug</a>
<br>
Committee e-mail: <a class="moz-txt-link-abbreviated" href="mailto:committee@plug.linux.org.au">committee@plug.linux.org.au</a>
<br>
<br>
</blockquote>
<br>
<br>
<div class="moz-signature">-- <br>
<title>Jonathan Young of PC-PHIX</title>
<meta http-equiv="Content-Type" content="text/html; ">
<meta http-equiv="Content-Language" content="en-us">
<meta name="Signature" content="Jonathan Young">
<meta name="Copyright" content="Copyright 1997 to 2004 PC-PHIX">
<font face="Verdana" size="2">
Jonathan Young<br>
Director of PC-PHIX<br>
<a class="moz-txt-link-abbreviated" href="mailto:jonathan@pcphix.com">jonathan@pcphix.com</a><br>
<br>
Phone: 0410 455 674<br>
Web: <a class="moz-txt-link-freetext" href="http://www.pcphix.com/">http://www.pcphix.com/</a><br>
<br>
</font> </div>
</body>
</html>