New subject: [Bug 424309] Provide ssh brute force attack prevention on by default

8 Sep 2008

      https://bugzilla.novell.com/show_bug.cgi?id=424309

           Summary: Provide ssh brute force attack prevention on by default
           Product: openSUSE 11.1
           Version: Factory
          Platform: Other
        OS/Version: Other
            Status: NEW
          Severity: Enhancement
          Priority: P5 - None
         Component: Security
        AssignedTo: security-team@suse.de
        ReportedBy: cyberorg@opensuse.org
         QAContact: qa@suse.de
          Found By: ---

/var/log/messages is full of ssh break in attempts, it would be great if
default SuSEfirewall rule could be provided which protects against this.

At the moment we have to resort to iptable rules like this with no idea of
their reliability.

iptables -N ssh-drop
iptables -A ssh-drop -m limit --limit 2/minute -j LOG --log-prefix
"SSH_THROTTLE: "
iptables -A ssh-drop -j DROP
iptables -A INPUT -p tcp --dport 22 --syn -m recent --name ssh --set
iptables -A INPUT -p tcp --dport 22 --syn -m recent --name ssh --update
--seconds 60 --hitcount 5 -j ssh-drop

-- 
Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug 424309] New: Provide ssh brute force attack prevention on by default

bugzilla_noreply＠novell.com

bugzilla_noreply＠novell.com

bugzilla_noreply＠novell.com

bugzilla_noreply＠novell.com

bugzilla_noreply＠novell.com

bugzilla_noreply＠novell.com

tags

participants (1)