SSH iptables Access Control

Method 1:

Add the IP addresses or CIDR blocks allowed for SSH login to/etc/hosts. allow.
Sshd: 192.168.1.2: Allow or

Sshd: 192.168.1.0/24: Allow

Add IP addresses not allowed for SSH login to/etc/hosts. Deny
Sshd: All # All indicates that all IP addresses except the ones permitted above refuse to log on to SSH

Method 2:

Use iptables.
Iptables-A input-p tcp-s 192.168.1.2 -- destination-port 22-J accept
Iptables-A input-p tcp -- destination-port 22-J Drop

Method 3:

Modify the SSH configuration file

VI/etc/ssh/sshd_config
Add a row:
Allowusers [email protected]
Note: XXX is your username used to log on to the server.

**************************************** *****************

Hidden and disguised port banner http://kangyang.blog.51cto.com/471772/580853

**************************************** ******************

Net session/delete/y

**************************************** ********

The appearance of Linux Server Attacks:

1. High latency from external Ping
2. high latency from internal ping Gateway
3. High memory and CPU usage
4. Many requests in the syn_recv status are displayed through netstat, And the refresh speed is slow.

AttacK Defense methods:

1. Set firewall rules

1.iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT

2.iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

3.iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

2. IP address and IP address segment

1.iptables -I INPUT -s 49.116.15.23 -j DROP     # Single IP Address

2.iptables -I INPUT -s 49.116.15.23/32 -j DROP  # As with the previous one, mail a single IP Address

3.iptables -I INPUT -s 49.116.15.0/24 -j DROP   # Specify the first three IP segments

4.iptables -I INPUT -s 49.116.0.0/16 -j DROP    # Specify only the first two IP segments

5.iptables -I INPUT -s 49.0.0.0/8 -j DROP       # Specify only the first IP segment

Here is a question: How do I know which IP addresses to use?
The answer is the netstat command.
View the current request through netstat. IP addresses frequently appearing in the syn_recv status are mostly malicious attacks.

The two methods must be combined to achieve remarkable results. This is my experience in maintaining high concurrency and high-traffic voting websites.

**************************************** *

SSH iptables Access Control