1 #! /bin/sh
   2 # Autor: Michael Bienia <michael@vorlon.ping.de>
   3 # nach einer Idee von http://blog.andrew.net.au/2005/02/17#ipt_recent_and_ssh_attacks
   4 
   5 IPT=/sbin/iptables
   6 DEV=servernet2
   7 PING_NETZ=83.97.48.0/21
   8 
   9 test -x $IPT || exit 0
  10 
  11 _start () {
  12 
  13 	$IPT -N SSH_BADGUYS
  14 	$IPT -A SSH_BADGUYS -m recent --name ssh_badguys --set
  15 	$IPT -A SSH_BADGUYS -j LOG --log-prefix "SSH scanner detected: "
  16 	$IPT -A SSH_BADGUYS -j REJECT --reject-with icmp-admin-prohibited
  17 	
  18 	$IPT -A INPUT -i $DEV -p tcp --dport 22 -s $PING_NETZ -m state --state NEW -j ACCEPT
  19 	$IPT -A INPUT -i $DEV -p tcp --dport 22 -m state --state NEW -m recent --name ssh_badguys --update --seconds 120 -j REJECT --reject-with icmp-admin-prohibited
  20 	$IPT -A INPUT -i $DEV -p tcp --dport 22 -m state --state NEW -m recent --set --name ssh
  21 	$IPT -A INPUT -i $DEV -p tcp --dport 22 -m state --state NEW -m recent --rcheck --seconds 60 --hitcount 5 --name ssh -j SSH_BADGUYS
  22 }
  23 
  24 _stop () {
  25 	# Vorsicht: löscht auch andere Regeln
  26 	#$IPT -F
  27 	#$IPT -X SSH_BADGUYS
  28 	:
  29 }
  30 
  31 case "$1" in
  32 	start)
  33 		echo -n "Starting SSH brute force blocker: "
  34 		_start
  35 		echo "done."
  36 		;;
  37 	stop)
  38 		echo -n "Stopping SSH brute force blocker: "
  39 		_stop
  40 		echo "done."
  41 		;;
  42 	restart)
  43 		echo -n "Restarting SSH brute force blocker: "
  44 		_stop
  45 		_start
  46 		echo "done."
  47 		;;
  48 	status)
  49 		if [ -r /proc/net/ipt_recent/ssh_badguys ]; then
  50 			cat /proc/net/ipt_recent/ssh_badguys
  51 		fi
  52 		;;
  53 	*)
  54 		echo "Usage: $0 {start|stop|restart|status}" >&2
  55 		exit 1
  56 		;;
  57 esac
  58 
  59 exit 0