This has been an annoyance for me for quite a while.

My home firewall host has the following rules added to the iptables ruleset to discourage such attacks:

-A INPUT -i eth1 -p tcp -m tcp --dport 22 -m state --state NEW -m recent --rcheck --seconds 180 --name sshrecent --rsource -j DROP

-A INPUT -i eth1 -p tcp -m tcp --dport 22 -m recent --set --name sshrecent --rsource

I've found this to be quite discouraging. If you want to try to guess my long, pseudo-random password over the course of 3 years, go ahead and try!

It's annoying to wait 180 seconds to connect again, but what are you gonna do? I'll definitely look into the blocking tool mentioned above. Thanks.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/infocus/1876/745#745