Hacker News Reader

Comment by 0xbadcafebee | Hacker News Reader

Gentle reminder that you do not need fail2ban to block repeat connection attempts. Two IPTables lines will block any IPs connecting over a given rate in a given time. A third line logs it.

View on HN

For pure ssh, this is true, but note that fail2ban can also automatically unblock after a certain amount of time, which is nice when valid users shut themselves out by mistake over the weekend... For other services, depending on their type, the false-positive rate will often be way too high.

Pam_shield works well for this, and doesn't have to troll logs to keep counts.

FWIW this can also be done with ipsets. [1] ipset hash tables are quite useful if you are blocking a large number of hosts. The CPU load is much lower than having individual rules for each host blocked. You can set any time limit on a ipset or have no time limit. You can also dynamically insert ip's into ipsets using iptables rules.

[1] - https://superuser.com/questions/1412286/time-limited-whiteli...

Fail2ban can protect any kind of application, not just SSH.

All they need to do is emit a structured log line format after a failed login attempt, or any other kind of undesirable behaviour.

Here's an example: https://www.rackaid.com/blog/how-to-block-ssh-brute-force-at...

You need fail2ban to block repeat failed login attempts. If you just use iptables, you can't distinguish between a failed SSH login and a short-lived successful one, and there's a lot of legitimate reasons you might have several short-lived successful ones in a row.

This is why we enable port knocking (SPA) on all of our Internet-facing systems: it protects against zero-days, keeps the logs pristine, and stops repeat connection attempts. As a matter fact, any failed login of any kind creates a security alert.

Care to provide those 3 lines?

Start with the basics:

  iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Allow loopback, icmp:

  iptables -A INPUT -i lo -m comment --comment "Allow loopback connections" -j ACCEPT
  iptables -A INPUT -p icmp -m comment --comment "Allow ICMP packets" -j ACCEPT

Limit ssh connections to 5 per minute, per source ipv4 host:

  iptables -A INPUT -i eth0 -p tcp --syn --dport 22 -m connlimit --connlimit-above 5 --connlimit-mask 32 -j REJECT --reject-with tcp-reset

Set maximum number of ssh connections to 100:

  iptables -t filter -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 100 -j DROP

Limit to only 5 new connections per second (This is what you probably want, ala Fail2ban):

  iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set
  iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 5 --name SSH --rsource -j DROP

Limit https connections to 150/second, after a burst of 300/second. Beware: once the limit is reached, I don't think it gets reset.

  iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state RELATED,ESTABLISHED -m limit --limit 150/second --limit-burst 300 -j ACCEPT

Similar limit, but with hashlimit module:

  iptables -A INPUT -i eth0 -p tcp --dport 443 -m hashlimit --hashlimit-name HTTPS --hashlimit-mode srcip --hashlimit 1/s --hashlimit-burst 300 -j ACCEPT

Don't forget to drop everything else:

  iptables -A INPUT -i eth0 -j DROP

Nice, thanks!

Reply on news.ycombinator.com