 | | | SSH Dictionary Attacks (does not work with EL3) | SSH Dictionary Attacks (does not work with EL3) 2006-01-12 - By bob
Back
i should learn to read before hitting send.
my eth0 looks like this...
#!/bin/bash
# rc.firewall script
# Set these variables
IPTABLES="/sbin/iptables"
INET_IFACE="eth0"
IP_NS1="1.2.3.4"
# Flush tables
/bin/echo "Flushing tables..."
$IPTABLES -F
# Set default policies for the INPUT, FORWARD and OUTPUT chains
/bin/echo "Setting default policies..."
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
# Traverse the INPUT chain
/bin/echo "Assembling the INPUT chain..."
$IPTABLES -A INPUT -p ALL -m state --state INVALID -j DROP
$IPTABLES -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
$IPTABLES -A INPUT -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p TCP -m recent --update --seconds 60 --hitcount 4 -j
DROP
#sshd
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -s 0/0 -d 2.3.4.5 --dport 223 -j
ACCEPT
misfire on the first post.
my .02
-bob
-- -- Original Message -- --
From: "Rainer Traut" <tr.ml@(protected)>
To: "Red Hat Enterprise Linux 4 (Nahant) Discussion List"
<nahant-list@(protected)>
Cc: <taroon-list@(protected)>
Sent: Thursday, January 12, 2006 4:09 AM
Subject: Re: SSH Dictionary Attacks (does not work with EL3)
> Hi,
>
> Thomas Cameron schrieb:
>> I know there are probably a million better ways to do this, but I just
>> ran the following two commands on all my Internet facing machines:
>>
>> iptables -I INPUT -p tcp --dport 22 -m state --state NEW \ -m
>> recent --update --seconds 60 --hitcount 4 -j DROP
>>
>> iptables -I INPUT -p tcp --dport 22 -m state --state NEW \ -m
>> recent --set
>>
>> I got them from http://www.debian-administration.org/articles/187 and
>> they seem to work quite nicely.
>
> Thx, for this.
> But I have couple of EL3 servers where I wanted to do this.
> But EL3 does not seem to work:
>
> iptables v1.2.8: Couldn't load match
> `recent':/lib/iptables/libipt_recent.so: cannot open shared object file:
> No such file or directory
>
> find /lib/ -iname "*recent*"
> shows:
> /lib/modules/2.4.21-37.ELsmp/kernel/net/ipv4/netfilter/ipt_recent.o
>
> I can modprobe the module, but that's all.
> Is there a workaround for this?
>
> Thx
> Rainer
>
> --
> Taroon-list mailing list
> Taroon-list@(protected)
> https://www.redhat.com/mailman/listinfo/taroon-list
--
Taroon-list mailing list
Taroon-list@(protected)
https://www.redhat.com/mailman/listinfo/taroon-list
|
|
|