[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: iptables question

On Thu, 1 Jan 2009, Napoleon wrote:

I'll admit I'm still pretty green at a lot of this (lots of experience in computers, little in Linux) and don't understand everything. But I'm trying to learn, so please go easy on me :-)

I've been having a problem with dictionary hacker attempts on my system (hundreds or even thousands a day), so I implemented the following rules:

# Kill ssh hackers - watch for more than 3 connection attempts in under
# 15 minutes seconds and reject for 24 hours
iptables -N SSH-EVIL
iptables -A SSH-EVIL -m recent --name badSSH --set -j LOG --log-level DEBUG --log-prefix "evil SSH user: "
iptables -A SSH-EVIL -j REJECT

iptables -N SSH
iptables -A SSH -p tcp ! --syn -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A SSH -p tcp --syn -m recent --name badSSH --rcheck --seconds 86400 -j REJECT iptables -A SSH -p tcp --syn -m recent --name sshconn --rcheck --seconds 900 --hitcount 3 -j SSH-EVIL
iptables -A SSH -p tcp --syn -m recent --name sshconn --set
iptables -A SSH -p tcp --syn -j ACCEPT

And something similar for ftp. These work well. But I'm also getting people trying to break in via the POP interface (I'm using qpopper). So I tried the following, which does not work:

iptables -N POP-EVIL
iptables -A POP-EVIL -m recent --name badPOP --set -j LOG --log-level DEBUG --log-prefix "evil POP user: "
iptables -A POP-EVIL -j REJECT

iptables -N POP
iptables -A POP -p tcp -i eth0 --dport 110 ! --syn -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A POP -p tcp -i eth0 --dport 110 -m recent --name badPOP --rcheck --seconds 86400 -j REJECT iptables -A POP -p tcp -i eth0 --dport 110 -m recent --name popconn --rcheck --seconds 900 --hitcount 5 -j POP-EVIL
iptables -A POP -p tcp -i eth0 --dport 110 -m recent --name popconn --set
iptables -A FTP -p tcp --syn -j ACCEPT

So my question is - what am I doing wrong in the POP interface, and how can I stop it here, also.

To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Solution: apt-get install fail2ban (read up on the docs, it can drop IPs based on attempts etc)


Reply to: