I am trying to limit number of ssh login attempts per time period. How might I do that?

I have something like (in shorewall's rules)

#ACTION         SOURCE          DEST            PROTO   DEST    SOURCE
#                                                       PORT    PORT(S)

Limit:info:SSHA,3,180   net     all     tcp     22

But it doesn't seem to work


You can use iptables to limit to 3 attempts per minute:

iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

Or use something like fail2ban. It bans by IP address for 15 minutes after 5 unsuccesfull login attempts.

  • OK, now it blocks me out, how do i remove this? I saved it too i think ... i dont see anything like what I typed in iptables -L or -S. also cant find it in history – Jiew Meng Dec 15 '11 at 10:13
  • The easiest way is flushing all INPUT rules with iptables -F INPUT. – rush Dec 15 '11 at 10:47
  • by flush you mean commit or remove? – Jiew Meng Dec 15 '11 at 23:07
  • I mean "remove". – rush Dec 16 '11 at 6:22

There are different tools to do this, like denyhosts http://denyhosts.sourceforge.net/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.