Comments on: Using IPTables to Prevent SSH Brute Force Attacks

By: ZenData

ZenData — Thu, 29 Sep 2011 20:18:30 +0000

Thanks … saved alot of time ….

By: Mark

Mark — Fri, 26 Aug 2011 16:47:06 +0000

Thanks for this. I didn’t even realize I had a problem until my /var volume filled up due to a tremendously large /var/log/btmp file. Combining this with blocking a few frequent ip addresses, and the problem seems to be under control.

By: A secure, standard iptables rule-set for a basic HTTP(s) webserver

A secure, standard iptables rule-set for a basic HTTP(s) webserver — Mon, 22 Nov 2010 03:36:57 +0000

[...] Also, rather than using Denyhosts or fail2ban you could use iptables itself to block bad repeated attempts at SSH. [...]

By: A secure, standard iptables rule-set for a basic HTTP(s) webserver | DeveloperQuestion.com

Mon, 04 Oct 2010 18:51:25 +0000

[...] Also, rather than using Denyhosts or fail2ban you could use iptables itself to block bad repeated attempts at SSH. [...]

By: Devon

Devon — Thu, 16 Sep 2010 15:13:38 +0000

Kevin,

looks good! Being a better net citizen is always good.

By: Kevin

Kevin — Wed, 15 Sep 2010 02:41:22 +0000

What do you think about using a ruby script like this:

http://github.com/nazar/report-hack-isp

in tandem with your iptables solution? I see iptables as protecting your server (or mine) and the script being proactive about protecting the web a little more by alerting the ISP in charge. Thoughts?

By: JD

JD — Thu, 01 Jul 2010 21:09:24 +0000

Thanks, great article!
How would you go about adding these blocks to a separate log file, say /var/log/iptables.log?

By: amdrew

amdrew — Mon, 03 May 2010 18:18:56 +0000

yea a simple solution, thanks for this great post :)

By: Devon

Devon — Mon, 09 Nov 2009 18:16:57 +0000

Good to know. It looks like the deamon mode is new-ish. However it defeats the non-root aspect you mention:

If you are running DenyHosts in daemon mode then yes you must run DenyHosts as root.

By: tx

tx — Mon, 09 Nov 2009 18:13:19 +0000

Denyhosts can be run in daemon mode which will actively monitor ssh logins and update hosts.deny immediately. Further it is possible to run the daemon as a non-root user (see http://denyhosts.sourceforge.net/faq.html#3_1). And lastly it is possible to tell denyhosts to block only a specified service instead of all services. Personally, I would rather block all communication from a compromised host.