ssh security

[Will Partain]

"jdow" <jdow at earthlink.net> writes:

> I have found, however, that a simple three line iptables addition seems
> to work like a champ, except for filling up the log.
>
> ===8<---
> iptables -A INPUT -p tcp --syn --dport 22 -m recent --name sshattack --set
> iptables -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \
>   --rcheck --seconds 120 --hitcount 3 -j LOG --log-prefix 'SSH REJECT: '
> $iptables -A INPUT -p tcp --dport 22 --syn -m recent --name sshattack \
>   --rcheck --seconds 120 --hitcount 3 -j REJECT --reject-with tcp-reset
> ===8<---

This is indeed a lovely approach, but has a drawback: it can't tell
the difference between many legit SSH connections and many bogus ones.

For example, if you are getting at a Subversion repository with
'svn+ssh://host/repo-stuff', then whole bunches of ssh connections
will be made in rapid succession.  You can always up the hitcount, but
that's just a method waiting to fail (e.g. what if SVN does something
unexpected that needs _lots_ of ssh connections).

Just FYI.

Will