'outside' SSH access: prevent password guessing

iMark writes:
This post is about security, a very touchy subject when it comes to computer networks.
The best computer security level you can accomplish is unplugging it from the network. However if you want to actually use your computer, balancing functionality against risk is the way to go.

The Risk
In my case, I want outside SSH access to my server with minimal risk. What is that risk? Password guessing by script kiddies. Many young hax0rs run a few scripts every night that randomly try thousands of different passwords on machines that are accessible over SSH.

The moment your machine is reachable on port 22, these scripts find you and your logs fill up with lines like these:

Dec 22 04:25:54 asterix sshd[19886]: reverse mapping checking getaddrinfo for 59.163.108.38.static-chennai.vsnl.net.in [59.163.108.38] failed - POSSIBLE BREAK-IN ATTEMPT!
Dec 22 04:25:54 asterix sshd[19886]: Failed password for root from 59.163.108.38 port 52523 ssh2
Dec 22 04:31:18 asterix sshd[19892]: Failed password for root from 120.105.81.155 port 55401 ssh2
Dec 22 04:31:58 asterix sshd[19918]: Invalid user oracle from 120.105.81.155
Dec 22 04:31:58 asterix sshd[19918]: Failed password for invalid user oracle from 120.105.81.155 port 58104 ssh2

If you have a strong root password, you are probably reasonably secure, however in time someone might get in. That is your risk, right there.

The Solution
So how do you stop it? Since you are running Linux, very easily, if you enter the following two iptables commands as root:

# iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
# iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 120 --hitcount 4 --rttl --name SSH -j DROP

(You might need to change the 'eth0' part into your external interface, likely eth1 or ppp0 or similar. )
What does this do? Whenever someone connects to your machines more than 3 times in two minutes, they are blocked for two minutes. This will effectively stop all password guessing scripts; they usually cannot handle this and crash or hang.


Minimize your risks!

Tech stuff: adding a static route on a SpeedTouch ST716

iMark writes:
I have a network with a Thomson SpeedTouch router which is my default gateway. Next to this, I have another computer on the network which is a router for a secondary subnet (with virtual machines).

My problem: I want the SpeedTouch to automatically handle this route, however there is no option in the web interface (at least on my ISP's version) to add routes.

My solution: add a static route using the telnet interface. Just telnet to your router using the telnet command and use the rtadd option:

Connected to speedtouch.           
Escape character is '^]'.          
Username : root                    
Password : ********                
------------------------------------------------------------------------

                             ______  SpeedTouch 716
                         ___/_____/\               
                        /         /\  6.2.29.2     
                  _____/__       /  \              
                _/       /\_____/___ \  Copyright (c) 1999-2007, THOMSON
               //       /  \       /\ \                                 
       _______//_______/    \     / _\/______                           
      /      / \       \    /    / /        /\                          
   __/      /   \       \  /    / /        / _\__                       
  / /      /     \_______\/    / /        / /   /\                      
 /_/______/___________________/ /________/ /___/  \                     
 \ \      \    ___________    \ \        \ \   \  /                     
  \_\      \  /          /\    \ \        \ \___\/                      
     \      \/          /  \    \ \        \  /                         
      \_____/          /    \    \ \________\/                          
           /__________/      \    \  /                                  
           \   _____  \      /_____\/                                   
            \ /    /\  \    /___\/                                      
             /____/  \  \  /                                            
             \    \  /___\/                                             
              \____\/                                                   

------------------------------------------------------------------------
_{root}=>ip
{root}[ip]=>rtadd
dst = 172.17.2.0
[dstmsk] = 255.255.255.0
[label] =
[gateway] = 172.16.48.2
[intf] = LocalNetwork
[srcintf] =
[metric] =
:ip rtadd dst=172.17.2.0/24 gateway=172.16.48.2 intf=LocalNetwork
{root}[ip]=>saveall

TIP: backspace in the CLI is Ctrl-H.
Now you are ready to test the new route from your workstation. Using ping on the commandline, you can see the route's effect through the redirect messages (at least on Linux):

root@obelix:~ # ping 172.17.2.91
PING 172.17.2.91 (172.17.2.91) 56(84) bytes of data.
64 bytes from 172.17.2.91: icmp_seq=1 ttl=63 time=1.24 ms
From 172.16.48.254: icmp_seq=1 Redirect Host(New nexthop: 172.16.48.2)

Happy networking!