4 ms·
Recent Google Cloud Engine images have Sshguard enabled by default. Now I do wonder: does this 'exploit' still cause a log line immediately after each attempt?
by praseodym 11y ago
Recent Google Cloud Engine images have Sshguard enabled by default.
Now I do wonder: does this 'exploit' still cause a log line immediately after each attempt? And also, do iptables firewall rules also apply to open connections, or just to new ones? In the latter case, Sshguard and fail2ban are circumvented for a rather high number of attempts.
- click170 11y agoIptables applies to all processed packets. One of the common gotchas though is that if you add a rule to allow "Established" connections, and then try to add a new rule after that which says "block IP X", that will not sever existing connections. To block existing connections you can remove that entry from the connection tracking table, or you can insert your "block IP X" rule above your "allow Established connections rule".
- kazinator 11y agoiptables rules can (trivially) apply to all traffic, or they can be sensitive to connection state. In the case of cracking, you'd just want to apply a blanket blan: completely black-hole any packet whatsoever coming from that IP to your box. That will freeze all existing connections. To ban new connections, you'd have a rule that applies to TCP connections in the NEW state, leaving the ESTABLISHED ones alone.
- rc4algorithm 11y agoIn many cases, this is a bad idea. For example, this is eventually equivalent to blocking Tor. I've been dealing with this issue lately.