On Thu, 2008-01-24 at 22:11 +0900, John Summerfield wrote: > -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -m limit --limit 5/hour -j LOG --log-prefix "SSH connexion " > -A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -m limit --limit 5/hour -j ACCEPT > -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j LOG --log-prefix "SSH connexion attack dropped " > -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j DROP But five naughty attempts during an hour that you were wanting to connect, and you've been DoSed... Unless other rules, such as: > Note too that this is my second access control; I run shorewall on > the Internet gateway, and that blocks great gobs of people who've > offended me. Ensure that doesn't happen. -- (This computer runs FC7, my others run FC4, FC5 & FC6, in case that's important to the thread.) Don't send private replies to my address, the mailbox is ignored. I read messages from the public lists.
