0

I have the following iptables file :

# Generated by iptables-save v1.4.21 on Sat Jul  8 11:48:38 2017
*raw
:PREROUTING ACCEPT [75178374:102748773110]
:OUTPUT ACCEPT [48791071:12009917336]
COMMIT
# Completed on Sat Jul  8 11:48:38 2017
# Generated by iptables-save v1.4.21 on Sat Jul  8 11:48:38 2017
*nat
:PREROUTING ACCEPT [30891:2719901]
:POSTROUTING ACCEPT [102225:7602312]
:OUTPUT ACCEPT [85794:6945072]
COMMIT
# Completed on Sat Jul  8 11:48:38 2017
# Generated by iptables-save v1.4.21 on Sat Jul  8 11:48:38 2017
*mangle
:PREROUTING ACCEPT [75178374:102748773110]
:INPUT ACCEPT [75177630:102748652126]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [48791071:12009917336]
:POSTROUTING ACCEPT [48791629:12010008074]
COMMIT
# Completed on Sat Jul  8 11:48:38 2017
# Generated by iptables-save v1.4.21 on Sat Jul  8 11:48:38 2017
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [260:167959]
:FILTER - [0:0]
:LOGDROP - [0:0]
:SERVICE - [0:0]
:SSH - [0:0]
-A INPUT -p icmp -m icmp --icmp-type 8 -m limit --limit 10/min -m comment --comment "Throttle pings to 10/m" -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -m comment --comment "Drop pings over threshold" -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment "Allow all established connections" -j ACCEPT
-A INPUT -i lo -m comment --comment "Allow loopback traffic" -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -m comment --comment "Drop invalid packets" -j DROP
-A INPUT -p tcp -m conntrack --ctstate NEW -m comment --comment "Pass TCP traffic to FILTER chain" -j FILTER
-A INPUT -p udp -m conntrack --ctstate NEW -m comment --comment "Pass UDP traffic to FILTER chain" -j FILTER
-A INPUT -m comment --comment "Reject other protocols" -j REJECT --reject-with icmp-proto-unreachable
-A FILTER -p tcp -m recent --update --seconds 60 --name BLACKLIST --rsource -m comment --comment "Block SYN scans" -j REJECT --reject-with tcp-reset
-A FILTER -p udp -m recent --update --seconds 60 --name BLACKLIST --rsource -m comment --comment "Block UDP scans" -j REJECT --reject-with icmp-port-unreachable
-A FILTER -m comment --comment "Pass traffic to SERVICE chain to check for valid service port" -j SERVICE
-A FILTER -p tcp -m recent --set --name BLACKLIST --rsource -m comment --comment "Blacklist SYN scans" -j REJECT --reject-with tcp-reset
-A FILTER -p udp -m recent --set --name BLACKLIST --rsource -m comment --comment "Blacklist UDP scans" -j REJECT --reject-with icmp-port-unreachable
-A LOGDROP -j LOG
-A LOGDROP -j DROP
-A SERVICE -i venet0 -p tcp -m tcp --dport 1984 -m comment --comment "Pass SSH to SSH chain" -j SSH
-A SERVICE -i venet0 -p tcp -m tcp --dport 443 -m comment --comment "Allow data HTTPS on 443" -j ACCEPT
-A SSH -m recent --rcheck --seconds 15 --hitcount 3 --rttl --name BRUTEFORCE --rsource -m comment --comment "Block SSH > 3 in 15s" -j LOGDROP
-A SSH -m recent --rcheck --seconds 900 --hitcount 10 --rttl --name BRUTEFORCE --rsource -m comment --comment "Block SSH > 10 in 900s" -j LOGDROP
-A SSH -m recent --set --name BRUTEFORCE --rsource -m comment --comment "Allow SSH not blacklisted" -j ACCEPT
COMMIT
# Completed on Sat Jul  8 11:48:38 2017

where SSH is passed from the TCP INPUT to the tcp FILTER chain then on to the SERVICE chain where it goes to the SSH chain in in theory should DROP and LOG any ssh failures based on the settings?

when i try this by ssh to the host and continually entering the wrong password for root it allows be 6 attempts before rejecting and not the 3 or 15 options?

based on the above rules is SSH chain setup correctly or have i missed something

Thanks

  • 1
    So, does it block at some point or not at all? The SSH connections can have multiple authentication attempts within the same connection, so you have take that into account. – ilkkachu Jul 8 '17 at 16:15
  • dont think so as i can attempt failed logins 6 times in around 20 seconds before being kicked off? – Dwayne Dibbley Jul 8 '17 at 16:33
  • so which one is it? Does it block or does it not block? How many connections can you make? That's not usually the same as the number of password login attempts you get. – ilkkachu Jul 9 '17 at 18:04
1

Problem solved, issue was with vps host logging kernel messages to /proc/kmsg

added $ModLoad imklog.so to rsyslog.conf and now i can see the iptables drop logs

So configuration was working just not logging correctly on the vps host

Thanks

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.