Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am trying to limit number of ssh login attempts per time period. How might I do that?

I have something like (in shorewall's rules)

#ACTION         SOURCE          DEST            PROTO   DEST    SOURCE
MARK
#                                                       PORT    PORT(S)

...
Limit:info:SSHA,3,180   net     all     tcp     22

But it doesn't seem to work

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

You can use iptables to limit to 3 attempts per minute:

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

Or use something like fail2ban. It bans by IP address for 15 minutes after 5 unsuccesfull login attempts.

share|improve this answer
    
OK, now it blocks me out, how do i remove this? I saved it too i think ... i dont see anything like what I typed in iptables -L or -S. also cant find it in history –  Jiew Meng Dec 15 '11 at 10:13
    
The easiest way is flushing all INPUT rules with iptables -F INPUT. –  rush Dec 15 '11 at 10:47
    
by flush you mean commit or remove? –  Jiew Meng Dec 15 '11 at 23:07
    
I mean "remove". –  rush Dec 16 '11 at 6:22
add comment

There are different tools to do this, like denyhosts http://denyhosts.sourceforge.net/

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.