Topic: Auto block ssh port when hammered by certain IP

[leto]

Using iptables, you can ban for like 5 minutes an IP that has failed X times.

It goes something like this :
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 300 --hitcount 10 -j DROP

That example bans for 300 seconds after 10 unsuccessful tries.

[leto]

Of course you'll need to replace 22 and eth0 with the port sshd is listening on and the name of your network iface.

[Curly]

I'm not sure, but I think that SME does not contain the neccesary module ipt_recent.