5 ms·

Gentle reminder that you do not need fail2ban to block repeat connection attempts. Two IPTables lines will block any IPs connecting over a given rate in a given

Gentle reminder that you do not need fail2ban to block repeat connection attempts. Two IPTables lines will block any IPs connecting over a given rate in a given time. A third line logs it.

josephcsible 5y ago
You need fail2ban to block repeat failed login attempts. If you just use iptables, you can't distinguish between a failed SSH login and a short-lived successful one, and there's a lot of legitimate reasons you might have several short-lived successful ones in a row.
hansjorg 5y ago
Here's an example: https://www.rackaid.com/blog/how-to-block-ssh-brute-force-attacks/ https://www.rackaid.com/blog/how-to-block-ssh-brute-force-at...
deng 5y ago
For pure ssh, this is true, but note that fail2ban can also automatically unblock after a certain amount of time, which is nice when valid users shut themselves out by mistake over the weekend... For other services, depending on their type, the false-positive rate will often be way too high.
- tyingq 5y ago
  Pam_shield works well for this, and doesn't have to troll logs to keep counts.
- LinuxBender 5y ago
  FWIW this can also be done with ipsets. [1] ipset hash tables are quite useful if you are blocking a large number of hosts. The CPU load is much lower than having individual rules for each host blocked. You can set any time limit on a ipset or have no time limit. You can also dynamically insert ip's into ipsets using iptables rules. [1] - https://superuser.com/questions/1412286/time-limited-whitelisting-of-ip-addresses-with-ipset-and-iptables https://superuser.com/questions/1412286/time-limited-whiteli...
piaste 5y ago
Fail2ban can protect any kind of application, not just SSH. All they need to do is emit a structured log line format after a failed login attempt, or any other kind of undesirable behaviour.
tambourine_man 5y ago
Care to provide those 3 lines?
- 0xbadcafebee 5y ago
  Start with the basics: iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT Allow loopback, icmp: iptables -A INPUT -i lo -m comment --comment "Allow loopback connections" -j ACCEPT iptables -A INPUT -p icmp -m comment --comment "Allow ICMP packets" -j ACCEPT Limit ssh connections to 5 per minute, per source ipv4 host: iptables -A INPUT -i eth0 -p tcp --syn --dport 22 -m connlimit --connlimit-above 5 --connlimit-mask 32 -j REJECT --reject-with tcp-reset Set maximum number of ssh connections to 100: iptables -t filter -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 100 -j DROP Limit to only 5 new connections per second (This is what you probably want, ala Fail2ban): iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 5 --name SSH --rsource -j DROP Limit https connections to 150/second, after a burst of 300/second. Beware: once the limit is reached, I don't think it gets reset. iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state RELATED,ESTABLISHED -m limit --limit 150/second --limit-burst 300 -j ACCEPT Similar limit, but with hashlimit module: iptables -A INPUT -i eth0 -p tcp --dport 443 -m hashlimit --hashlimit-name HTTPS --hashlimit-mode srcip --hashlimit 1/s --hashlimit-burst 300 -j ACCEPT Don't forget to drop everything else: iptables -A INPUT -i eth0 -j DROP
  - tambourine_man 5y ago
    Nice, thanks!
staysafeanon 5y ago
This is why we enable port knocking (SPA) on all of our Internet-facing systems: it protects against zero-days, keeps the logs pristine, and stops repeat connection attempts. As a matter fact, any failed login of any kind creates a security alert.

Gentle reminder that you do not need fail2ban to block repeat connection attempts. Two IPTables lines will block any IPs connecting over a given rate in a given time. A third line logs it.

josephcsible 5y ago

You need fail2ban to block repeat failed login attempts. If you just use iptables, you can't distinguish between a failed SSH login and a short-lived successful one, and there's a lot of legitimate reasons you might have several short-lived successful ones in a row.

hansjorg 5y ago

Here's an example: https://www.rackaid.com/blog/how-to-block-ssh-brute-force-attacks/ https://www.rackaid.com/blog/how-to-block-ssh-brute-force-at...

deng 5y ago

For pure ssh, this is true, but note that fail2ban can also automatically unblock after a certain amount of time, which is nice when valid users shut themselves out by mistake over the weekend... For other services, depending on their type, the false-positive rate will often be way too high.

tyingq 5y ago
Pam_shield works well for this, and doesn't have to troll logs to keep counts.
LinuxBender 5y ago
FWIW this can also be done with ipsets. [1] ipset hash tables are quite useful if you are blocking a large number of hosts. The CPU load is much lower than having individual rules for each host blocked. You can set any time limit on a ipset or have no time limit. You can also dynamically insert ip's into ipsets using iptables rules. [1] - https://superuser.com/questions/1412286/time-limited-whitelisting-of-ip-addresses-with-ipset-and-iptables https://superuser.com/questions/1412286/time-limited-whiteli...

piaste 5y ago

Fail2ban can protect any kind of application, not just SSH. All they need to do is emit a structured log line format after a failed login attempt, or any other kind of undesirable behaviour.

tambourine_man 5y ago

Care to provide those 3 lines?

0xbadcafebee 5y ago
Start with the basics: iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT Allow loopback, icmp: iptables -A INPUT -i lo -m comment --comment "Allow loopback connections" -j ACCEPT iptables -A INPUT -p icmp -m comment --comment "Allow ICMP packets" -j ACCEPT Limit ssh connections to 5 per minute, per source ipv4 host: iptables -A INPUT -i eth0 -p tcp --syn --dport 22 -m connlimit --connlimit-above 5 --connlimit-mask 32 -j REJECT --reject-with tcp-reset Set maximum number of ssh connections to 100: iptables -t filter -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 100 -j DROP Limit to only 5 new connections per second (This is what you probably want, ala Fail2ban): iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 5 --name SSH --rsource -j DROP Limit https connections to 150/second, after a burst of 300/second. Beware: once the limit is reached, I don't think it gets reset. iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state RELATED,ESTABLISHED -m limit --limit 150/second --limit-burst 300 -j ACCEPT Similar limit, but with hashlimit module: iptables -A INPUT -i eth0 -p tcp --dport 443 -m hashlimit --hashlimit-name HTTPS --hashlimit-mode srcip --hashlimit 1/s --hashlimit-burst 300 -j ACCEPT Don't forget to drop everything else: iptables -A INPUT -i eth0 -j DROP
- tambourine_man 5y ago
  Nice, thanks!

staysafeanon 5y ago

This is why we enable port knocking (SPA) on all of our Internet-facing systems: it protects against zero-days, keeps the logs pristine, and stops repeat connection attempts. As a matter fact, any failed login of any kind creates a security alert.