Monitor and block SSH connection attempts

Monitor and block SSH connection attempts.

Here is a simple guide for iptables...

This will set iptables to default:

........

sudo iptables -P INPUT ACCEPT

sudo iptables -P OUTPUT ACCEPT

sudo iptables -P FORWARD ACCEPT

Then flush the rules:

sudo iptables -F INPUT

sudo iptables -F OUTPUT

sudo iptables -F FORWARD

This allows you to view your current rules:

$ sudo iptables -L

........

Install iptables-persistent package to save tables on reboot.

$ sudo apt-get install iptables-persistent

During the installation, you will asked if you want to save your current firewall rules.

If you update your firewall rules and want to save the changes, run this command:

$ sudo netfilter-persistent save

$ sudo netfilter-persistent reload

........

With the following, an attacker is allowed to produce exactly 3 faulty logins in 2 minutes. Afterwards, they will be blocked for 120 seconds.

1) Add the following line to /etc/ssh/sshd_config

MaxAuthTries 1

This will allow only 1 login attempt per connection. Restart the ssh server.

2) Add the following firewall rules:

Create a new chain:

$ sudo iptables -N SSHATTACK

$ sudo iptables -A SSHATTACK -j LOG --log-prefix "Possible SSH attack! " --log-level 7

$ sudo iptables -A SSHATTACK -j DROP

If you need to ever remove or flush the chain, use these commands:

$ sudo iptables -D SSHATTACK

$ sudo iptables --flush SSHATTACK

$ sudo iptables -X SSHATTACK

$ sudo iptables -L

In case of the forth connection attempt, the request gets delegated to the SSHATTACK chain, which is responsible for logging the possible ssh attack and dropping the request.

You may need to change wlan0 to eth0 or whatever network interface you are using. Also make sure your port number is correct. It is 22 in this case.

$ sudo iptables -A INPUT -i wlan0 -p tcp -m state --dport 22 --state NEW -m recent --set

$ sudo iptables -A INPUT -i wlan0 -p tcp -m state --dport 22 --state NEW -m recent --update --seconds 120 --hitcount 4 -j SSHATTACK

3) See log entries of possible shh- attacks in /var/log/syslog

....

This will only allow 4 TCP/SYN packets to port 22 from an IP address in 5 minutes. If more attempts are made, the door will be closed for 5 minutes.

$ sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT

$ sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 300 --hitcount 4 --rttl --name SSH -j DROP