4 ms·
I have a utility that parses ssh failed attempts and creates iptables blocklists: https://gitlab.com/mtekman/iptables-autobanner https://gitlab.com/mtekman/ipt
by mtekman 2y ago
I have a utility that parses ssh failed attempts and creates iptables blocklists:
https://gitlab.com/mtekman/iptables-autobanner https://gitlab.com/mtekman/iptables-autobanner
For those just wanting the blocklist, here is a table of malicious IP addresses, with columns of: address, number of ports tried, number of usernames tried.
https://upaste.de/bgC https://upaste.de/bgC
- securethrowaway 2y agoI simply run fail2ban with a whole bunch of customer filters that will ban people very quickly. There's no need to request php or malformed urls when php is not used for example.
- mtekman 2y agoI used to run fail2ban, but I found it (or at least its defaults) ineffective against discouraging further requests. With iptables, you can specify the connection to hang for a period and then drop
- justsomehnguy 2y agoDefaults are set to reject. Just configure the jails or a global config.
- eps 2y agoupaste link is 404
- miah_ 2y agoA iptables hashlimit rule can do the same. Your firewall rules get to be more readable and you don't end up relying on the security of a log parser. The biggest win comes from just disabling password authentication in sshd though.
- sambazi 2y agoa lot of ppl thought this would be a good idea at some point
- Phelinofist 2y agoI run endlessh, I always giggle when I see some connection that last for 2d