Anti-Hammering létezik ftp, ill. ssh serverre?

ugyan ilyet még nem csináltam, de iptables tökéletes a feladatra. ugyanúgy betudod állítani, hogy hány request/sec jöhet egy portra, és utána tiltsa azt le...

A fail2ban a csomag neve, amit megnézz. Az iptables kell neki, mert azzal működik. Meg asszem perl vagy python. De majd meglátod.

--
"SzAM-7 -es, tudjátok amivel a Mirage-okat szokták lelőni" - Robi.

erre nalam egy ilyen van iptables-ben:

iptables -A INPUT -p tcp --syn --dport ssh -m recent --update --seconds 60 --hitcount 3 -j DROP
iptables -A INPUT -p tcp --syn --dport ssh -m recent --set -j ACCEPT

Persze iptables-t csak ugy, ha erted is, mit csinalsz...

Ez:

"Limiting Per-IP Connection Rate
Beginning with Shorewall 3.0.4, Shorewall has a “Limit” action. Limit is invoked with a comma-separated list in place of a logging tag. The list has three elements:
The name of a “recent” set; you select the set name which must conform to the rules for a valid chain name. Different rules that specify the same set name will use the same set of counters.
The number of connections permitted in a specified time period.
The time period, expressed in seconds.
Connections that exceed the specified rate are dropped.
For example, to use a recent set name of SSHA, and to limit SSH connections to 3 per minute, use this entry in /etc/shorewall/rules:
#ACTION SOURCE DEST PROTO DEST PORT(S)
Limit:none:SSHA,3,60 net $FW tcp 22
If you want dropped connections to be logged at the info level, use this rule instead:
#ACTION SOURCE DEST PROTO DEST PORT(S)
Limit:info:SSHA,3,60 net $FW tcp 22
To summarize, you pass four pieces of information to the Limit action:
The log level. If you don't want to log, specify “none”.
The name of the recent set that you want to use (“SSHA” in this example).
The maximum number of connections to accept (3 in this example).
The number of seconds over which you are willing to accept that many connections (60 in this example)."

nem valami ilyesmi?

------------------------
Debian testing KDE amd64
MSI K8N-Neo-4, Athlon64 3800+, Leadtek 6600GT

En ezt hasznalom:

http://denyhosts.sourceforge.net/

$ apt-cache show sshguard
Package: sshguard
Priority: optional
Section: net
Installed-Size: 92
Maintainer: Ernesto Nadir Crespo Avila <ecrespo@debianvenezuela.org>
Architecture: i386
Version: 1.0-2
Depends: libc6 (>= 2.7-1)
Filename: pool/main/s/sshguard/sshguard_1.0-2_i386.deb
Size: 23808
MD5sum: f181c76784249276c0690d3983fcaed2
SHA1: ba7d45fbbd4bc8e99281aa1c4d0728a311e602ac
SHA256: ab6abd815017163b120d280da54c6e5d263fbeb59aab72ce1976018557d5fb62
Description: protects from brute force attacks against ssh
 Protects networked hosts from the today's widespread
 brute force attacks against ssh servers. It detects such attacks
 and blocks the author's address with a firewall rule.
Homepage: http://sshguard.sourceforge.net/
Tag: implemented-in::c, role::program, security::firewall, security::ids

Esetleg így:

iptables -A INPUT -m tcp -p tcp --dport 22 -m state --state NEW \
	-m hashlimit --hashlimit-name sshlimit --hashlimit-mode srcip \
	--hashlimit 1/minute --hashlimit-burst 3 -j ACCEPT
iptables -A INPUT -m tcp -p tcp --dport 22 -j DROP

Szerk.: Annyiban különbözik a fenti recent modulos szabálytól, hogy per IP limitál.

--
40% of OpenBSD installs lead to shark attacks. It's their only standing security issue.

Nalam egyszeruen nem def porton figyel az sshd.