4 ms·
One to two lines of iptables limits connection attempts, making a brute force attack take thousands of years. No logging, no monitoring, no extra software. If
by throwaway892238 4y ago
One to two lines of iptables limits connection attempts, making a brute force attack take thousands of years. No logging, no monitoring, no extra software.
If you only use SSH keys, no brute force attack will work anyway.
https://www.systutorials.com/how-to-use-iptables-to-limit-rates-new-ssh-incoming-connections-from-each-ip-on-linux/ https://www.systutorials.com/how-to-use-iptables-to-limit-ra... https://making.pusher.com/per-ip-rate-limiting-with-iptables/ https://making.pusher.com/per-ip-rate-limiting-with-iptables... https://stackoverflow.com/questions/18616246/iptables-limit-number-of-new-ssh-connections-per-minute https://stackoverflow.com/questions/18616246/iptables-limit-... https://blog.oshim.net/2009/06/iptables-to-rate-limit-incoming/ https://blog.oshim.net/2009/06/iptables-to-rate-limit-incomi... https://stackoverflow.com/questions/47775809/iptables-rate-limiting-connection-request#48194151 https://stackoverflow.com/questions/47775809/iptables-rate-l... http://blog.serverbuddies.com/using-iptables-to-rate-limit-incoming-connections/ http://blog.serverbuddies.com/using-iptables-to-rate-limit-i...
- josephcsible 4y agoThe iptables methods all have the flaw that multiple sequential short-lived successful connections will trigger a ban too. Limiting Internet-facing SSH connections to key-only is definitely a good idea, though.
- cillian64 4y agoI experienced this at a previous company. Yocto/bitbake wanted to do a lot of git clones over SSH very quickly, but a firewall interpreted this as a brute force because it couldn’t tell that each SSH connection was actually successfully authenticating.
- 5e92cb50239222b 4y agoYou can enable SSH connection persistence by adding this to ~/.ssh/config: ServerAliveInterval 60 ControlMaster auto ControlPath ~/.ssh/conn/%r@%h:%p ControlPersist 1h I use it to speed up new SSH connections after the first one is made, but it should also prevent the issue you've described.