Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to limit number of ssh login attempts per time period. How might I do that?

I have something like (in shorewall's rules)

#ACTION         SOURCE          DEST            PROTO   DEST    SOURCE
#                                                       PORT    PORT(S)

Limit:info:SSHA,3,180   net     all     tcp     22

But it doesn't seem to work

share|improve this question
up vote 5 down vote accepted

You can use iptables to limit to 3 attempts per minute:

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

Or use something like fail2ban. It bans by IP address for 15 minutes after 5 unsuccesfull login attempts.

share|improve this answer
OK, now it blocks me out, how do i remove this? I saved it too i think ... i dont see anything like what I typed in iptables -L or -S. also cant find it in history – Jiew Meng Dec 15 '11 at 10:13
The easiest way is flushing all INPUT rules with iptables -F INPUT. – rush Dec 15 '11 at 10:47
by flush you mean commit or remove? – Jiew Meng Dec 15 '11 at 23:07
I mean "remove". – rush Dec 16 '11 at 6:22

There are different tools to do this, like denyhosts http://denyhosts.sourceforge.net/

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.