Rate limit the SSH Bruteforce

The following iptables will help limit the bruteforce attacks on your ssh port. With the recent exploit found in BASH, there’s been renewed interest in exploitable CGI/Web and SSH ports.


sudo /sbin/iptables -N LOGDROP
sudo /sbin/iptables -A LOGDROP -j LOG
sudo /sbin/iptables -A LOGDROP -j DROP
sudo iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
sudo iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j LOGDROP

As seen on http://www.rackaid.com/blog/how-to-block-ssh-brute-force-attacks/