Linux System Administration Recipes A Problem-Solution Approach

CHAPTER 6 ■ SECURING YOUR SYSTEMS6-13. Stopping Brute-Force Attacks with iptablesBrute-force ssh attacks are where an attacker just repeatedly tries to log into your machine via ssh with aseries of usernames and/or passwords. They are an unfortunate fact of life if you run any machine thathas its SSH port open to the wider world.■ Note It’s worth considering whether you really need the SSH port of each machine open to the world outsideyour own network; your Kerberos and LDAP servers, for example, probably shouldn’t be, and even a web serverneedn’t be open on the SSH port, only the Apache port(s). If you need to log into these servers from home, you canget in via another machine. You could even insist that anyone wanting to log into the network from outside come invia a single gateway machine, but this may be more hassle (from a user management perspective) than it’s worthfor desktop machines. Users shouldn’t be allowed to log into your servers anyway; see recipe 6-3 for informationon the AllowUsers directive.One option for dealing with this problem is to use a solution that monitors how many connectionsare coming from a single IP address and blocks that IP address if there are too many in a set time period.The iptables limit module is good for this.First, let’s look at a basic iptables setup for a machine with IP address 192.168.100.25 on the192.168.100.0/255.255.255.0 subnet (that is, machines with IP addresses 192.168.100.*):01 iptables -A INPUT -d 127.0.0.0/255.0.0.0 -i ! lo -p tcp -j DROP02 iptables -A INPUT -d 192.168.100.25 -m state --state RELATED,ESTABLISHED -j ACCEPT03 iptables -A INPUT -i lo -j ACCEPT04 iptables -A INPUT -s 192.168.100.0/255.255.255.0 -d 192.168.100.25 -j ACCEPT05 iptables -A INPUT -d 192.168.100.25 -p tcp -m tcp --dport 22 -j LOG --log-prefix "ssh:"06 iptables -A INPUT -d 192.168.100.25 -p tcp -m tcp --dport 22 -j ACCEPT07 iptables -P INPUT DROP08 iptables -P FORWARD DROP09 iptables -P OUTPUT ACCEPTLine 01 drops anything coming in on 127.0.0.0 that isn’t using the loopback address. Line 02 acceptsany packets related to an established connection with this machine (-d x.x.x.x means that the packetdestination is x.x.x.x). Line 03 accepts anything coming in on the loopback address. Line 04unconditionally accepts any packet from the local network (192.168.100.*) that has a destination of thismachine’s IP.Lines 05 and 06 log any SSH packets coming in and then accept them.Lines 07–09 set the default policy for the INPUT and FORWARD chains to be to drop packets, so anythingthat hasn’t matched one of the previous rules will be dropped. For OUTPUT, we accept everything.OK, now let’s set up the limit module. The easiest way to do this is to create a new chain:iptables -N SSHIf you now type iptables -L, you’ll see all the chains and your new chain at the end of them. Nowlet’s set the rules for this chain:151Download at WoweBook.Com