change SSH Brute Force Protection

[caxap]

I use my router as SSH proxy with up to 15 connections from the same IP at a time. That triggers a bruteforce protection hitcount.
I don't want to disable a bruteforce protection completely. What would be the best way to increase hitcount number?

 

[RMerlin]

You could whitelist that IP by adding an iptables rule that will skip the BFD rules when connections are from your static IP.

 

[caxap]

You could whitelist that IP

Not an option, my IP is dynamic.

 

[Ferisko]

Hi,

you could disable the built in brute force protection in web ui and then add a custom firewall-start script with your own iptables brute force protection lines:

user@router:/tmp/home/root# cat /jffs/scripts/firewall-start
#!/bin/sh
iptables -I INPUT 6 -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -I INPUT 7 -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 300 --hitcount 6 --rttl --name SSH -j DROP
user@router:/tmp/home/root#

Tune hitcount and seconds parameters according to your needs. You might also need to adjust the input line numbers if you have other non-default iptables rules in place.

After router restart the input chain in iptables should look something like this:

user@router:/tmp/home/root# iptables -L -v --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 DROP       icmp --  eth0   any     anywhere             anywhere             icmp echo-request
2    1478K  188M ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
3      128  8722 DROP       all  --  any    any     anywhere             anywhere             state INVALID
4     702K  106M PTCSRVWAN  all  --  !br0   any     anywhere             anywhere
5     651K   95M PTCSRVLAN  all  --  br0    any     anywhere             anywhere
6        0     0            tcp  --  eth0   any     anywhere             anywhere             tcp dpt:ssh state NEW recent: SET name: SSH side: source
7        0     0 DROP       tcp  --  eth0   any     anywhere             anywhere             tcp dpt:ssh state NEW recent: UPDATE seconds: 300 hit_count: 6 TTL-Match name: SSH side: source
8     651K   95M ACCEPT     all  --  br0    any     anywhere             anywhere             state NEW
9     702K  106M ACCEPT     all  --  lo     any     anywhere             anywhere             state NEW
10     208 33285 OVPN       all  --  any    any     anywhere             anywhere             state NEW
11       0     0 ACCEPT     udp  --  any    any     anywhere             anywhere             udp spt:bootps dpt:bootpc
12       0     0 INPUT_ICMP  icmp --  any    any     anywhere             anywhere
13     208 33285 DROP       all  --  any    any     anywhere             anywhere
<snip>

 

[caxap]

you could disable the built in brute force protection in web ui and then add a custom firewall-start script with your own iptables brute force protection lines

before disabling brute force protection:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1      515 63939 PTCSRV     tcp  --  any    any     anywhere             anywhere             multiport dports 3333
2       56  2240 DROP       all  --  any    any     anywhere             anywhere             state INVALID
3     3741  525K ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
4      300 22473 ACCEPT     all  --  lo     any     anywhere             anywhere             state NEW
5      510 42334 ACCEPT     all  --  br0    any     anywhere             anywhere             state NEW
6        0     0 ACCEPT     udp  --  any    any     anywhere             anywhere             udp spt:bootps dpt:bootpc
7        4   208 SSHBFP     tcp  --  any    any     anywhere             anywhere             tcp dpt:3333 state NEW
8      394 69390 DROP       all  --  any    any     anywhere             anywhere

Chain FORWARD (policy DROP 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 DROP       all  --  vlan2  any     anywhere             anywhere             state INVALID
2     1249 67570 ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
3        0     0 DROP       all  --  !br0   vlan2   anywhere             anywhere
4        0     0 ACCEPT     all  --  br0    br0     anywhere             anywhere
5        0     0 DROP       icmp --  vlan2  any     anywhere             anywhere
6        0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT
7      266 17729 ACCEPT     all  --  br0    any     anywhere             anywhere

Chain OUTPUT (policy ACCEPT 4804 packets, 762K bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain FUPNP (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain PControls (0 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 ACCEPT     all  --  any    any     anywhere             anywhere

Chain PTCSRV (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain SSHBFP (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1        4   208            all  --  any    any     anywhere             anywhere             recent: SET name: SSH side: source
2        0     0 DROP       all  --  any    any     anywhere             anywhere             recent: UPDATE seconds: 60 hit_count: 4 name: SSH side: source
3        4   208 ACCEPT     all  --  any    any     anywhere             anywhere

Chain logaccept (0 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        all  --  any    any     anywhere             anywhere             state NEW LOG level warning tcp-sequence tcp-options ip-options prefix "ACCEPT "
2        0     0 ACCEPT     all  --  any    any     anywhere             anywhere

Chain logdrop (0 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        all  --  any    any     anywhere             anywhere             state NEW LOG level warning tcp-sequence tcp-options ip-options prefix "DROP "
2        0     0 DROP       all  --  any    any     anywhere             anywhere

I've adjusted your lines a bit:

#!/bin/sh
iptables -I INPUT 6 -i any -p tcp --dport 3333 -m state --state NEW -m recent --set --name SSH
iptables -I INPUT 7 -i any -p tcp --dport 3333 -m state --state NEW -m recent --update --seconds 300 --hitcount 15 --rttl --name SSH -j DROP

Now printout looks like:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1      489  109K PTCSRV     tcp  --  any    any     anywhere             anywhere             multiport dports 3333
2       22 19594 DROP       all  --  any    any     anywhere             anywhere             state INVALID
3      876  200K ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
4        9  1098 ACCEPT     all  --  lo     any     anywhere             anywhere             state NEW
5       52  7930 ACCEPT     all  --  br0    any     anywhere             anywhere             state NEW
6        0     0            tcp  --  any    any     anywhere             anywhere             tcp dpt:3333 state NEW recent: SET name: SSH side: source
7        0     0 DROP       tcp  --  any    any     anywhere             anywhere             tcp dpt:3333 state NEW recent: UPDATE seconds: 300 hit_count: 15 TTL-Match name: SSH side: source
8        0     0 ACCEPT     udp  --  any    any     anywhere             anywhere             udp spt:bootps dpt:bootpc
9       17   884 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:3333
10     115 36608 DROP       all  --  any    any     anywhere             anywhere

Chain FORWARD (policy DROP 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 DROP       all  --  vlan2  any     anywhere             anywhere             state INVALID
2       42  2280 ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED
3        0     0 DROP       all  --  !br0   vlan2   anywhere             anywhere
4        0     0 ACCEPT     all  --  br0    br0     anywhere             anywhere
5        0     0 DROP       icmp --  vlan2  any     anywhere             anywhere
6        0     0 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate DNAT
7       89  9420 ACCEPT     all  --  br0    any     anywhere             anywhere

Chain OUTPUT (policy ACCEPT 1054 packets, 215K bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain FUPNP (0 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain PControls (0 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 ACCEPT     all  --  any    any     anywhere             anywhere

Chain PTCSRV (1 references)
num   pkts bytes target     prot opt in     out     source               destination

Chain logaccept (0 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        all  --  any    any     anywhere             anywhere             state NEW LOG level warning tcp-sequence tcp-options ip-options prefix "ACCEPT "
2        0     0 ACCEPT     all  --  any    any     anywhere             anywhere

Chain logdrop (0 references)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        all  --  any    any     anywhere             anywhere             state NEW LOG level warning tcp-sequence tcp-options ip-options prefix "DROP "
2        0     0 DROP       all  --  any    any     anywhere             anywhere

I'm trying to "brute force" and see no protection working. Could you please take a look what is wrong?
I'm really new to linux and iptables.
Thanks

 

[RMerlin]

Not an option, my IP is dynamic.

Whitelist the whole subnet then. Chances that you have an attacker from within the same subnet are probably low. Still better than completely disabling BFD for every sources.

 

[caxap]

Whitelist the whole subnet then. Chances that you have an attacker from within the same subnet are probably low. Still better than completely disabling BFD for every sources.

I'm using ssh proxy from different locations while moving.
If whitelisting is the only option then sure I can whitelist IP just before using proxy. But it adds extra steps every time.

Can IP be whitelisted from cli?

 

[RMerlin]

I'm using ssh proxy from different locations while moving.
If whitelisting is the only option then sure I can whitelist IP just before using proxy. But it adds extra steps every time.

Can IP be whitelisted from cli?

You need to edit your custom firewall-start script, then restart the firewall.