How can I limit ssh connection attempts via UFW?

[jocampo]

I am trying to accomplish this but via UFW

sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP

Can I do the same with UFW rules? I am just trying to minimize or reduce Brute Force Attacks. Right now I have two main rules using UFW: one allowing SSH and other one allowing WWW (port 80) I would like to keep those but limiting the number of ssh connections per min also with above mentioned iptable rules...

Thanks in advance,

[cdenley]

sudo ufw limit ssh/tcp

From:

man ufw

ufw supports connection rate limiting, which is useful for protecting
against brute-force login attacks. ufw will deny connections if an IP
address has attempted to initiate 6 or more connections in the last 30
seconds. See http://www.debian-administration.org/articles/187 for
details.

[bodhi.zazen]

Or you can add those (iptables) rules in the ufw config files

/etc/ufw/before.rules

[jocampo]

cdenley / bodhi

Thanks for reply, couple of questions ...

1. What's the purpose of "limit" when using UFW?
2. How can I add UFW tables, via "iptable" command?

This is what I was trying to do and for some reason is not working.

udo ufw allow ssh
sudo ufw allow www
sudo ufw default deny

sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 --rttl --name SSH -j DROP

The UFW lines work, but when I try to edit the iptables so I can restrict the number of ssh loging attempts to 3/min, it does nothing. I want to block all traffic but ssh and www but at same time, restrict the login attempts 'cause I recieve brute force attacks almost every day. Yes I am using denyhosts, no! I won't and I can not change port 22

I want to limit the login attempts via iptables but combining that with UFW rules.

[cdenley]

1.

sudo ufw limit ssh/tcp

The above command effectively does the same thing as

sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 30 --hitcount 6 --rttl --name SSH -j DROP

2.
If you append rules after UFW already created iptables rules, then your rules will only be checked if a UFW chain hasn't already accepted the packet. If you want to add the rules using the "iptables" command, use insert (-I) instead of append (-A).

If you want to configure UFW to add those custom iptables rules, add this to /etc/ufw/before.rules before "COMMIT":

-A ufw-before-input -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
-A ufw-before-input -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 3 --rttl --name SSH -j DROP

[jocampo]

[QUOTE=cdenley;7917578]1.

sudo ufw limit ssh/tcp

Thanks for reply

But, where do you specify the max attempts, like 3 per min, etc... and the timeframe, 60secs on this case

[cdenley]

But, where do you specify the max attempts, like 3 per min, etc... and the timeframe, 60secs on this case

It does not appear that you can with the ufw command. It only filters after "6 or more connections in the last 30 seconds".

[jocampo]

It does not appear that you can with the ufw command. It only filters after "6 or more connections in the last 30 seconds".

Got it, so ... in order to accomplish my goal, should I?

sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP

and then ...

sudo ufw default deny

[cdenley]

No, that will still append your rules after UFW's chains. You want to insert your rules before the UFW chains.

sudo iptables -I 1 INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
sudo iptables -I 2 INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP

[jocampo]

Ok

Let me try ... i understand UFW a bit but the way IPTABLES work, CHAINS, rules inside chains and precede, etc, is kind of confusing....

Thanks a lot for your help so far