| View previous topic :: View next topic |
| Author |
Message |
wallace1819
Apprentice
Joined: 17 Aug 2002
Posts: 195
Location: VT
|
 Posted: Wed May 28, 2003 3:46 pm Post subject: iptables syntax question... |
 |
|
if I want to log all attempted incomming ssh connections is it better to use ...
| Code: |
$IPTABLES -A allow-ssh-traffic-in -p tcp --source-ports ssh --tcp-flags ALL SYN -j LOG --log-prefix "SSH-IN:"
|
or...
| Code: |
$IPTABLES -A allow-ssh-traffic-in -p tcp --source-ports ssh --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SSH-IN:"
|
the man pages sugests the 2ed option but is there any reason you all can think of not to use the first option?
wallace |
|
| Back to top |
|
 |
xedx
Tux's lil' helper
Joined: 23 May 2003
Posts: 93
|
| Posted: Thu May 29, 2003 5:20 am Post subject: ? |
|
|
the 1st option which indicates ALL SYN is an illegal combination if im right its a syn flood
_________________
--+//+ |
|
| Back to top |
|
|
psp
Tux's lil' helper
Joined: 06 Aug 2002
Posts: 120
Location: Cape Town, South Africa
|
| Posted: Thu May 29, 2003 12:53 pm Post subject: |
|
|
Perhaps it's for speed? Less flags to check. That's the only reason I can think.
Why do you use "--source-ports ssh" when you want incoming ssh connections. i.e. connections to your ssh server (dport 22)?
I use:
| Code: |
iptables -A ssh-in -i $ETH_IN -p tcp -s 0/0 -d my.ip.addr --dport 22 -m state --state NEW -j LOG --log-prefix "SSH-IN: "
|
This makes good use of iptables stateful inspection and should only log good connections.
xedx: The syntax "ALL SYN" means... check ALL the flags and make sure that only SYN is set.
Hope this helps... |
|
| Back to top |
|
|
wallace1819
Apprentice
Joined: 17 Aug 2002
Posts: 195
Location: VT
|
| Posted: Thu May 29, 2003 1:01 pm Post subject: thx! |
|
|
nice catch on the --source-ports mistake! Thx. and thx for the input.
another question... would a statement like ....
| Code: | | $IPTABLES -A allow-ssh-traffic-in -p tcp --dport ssh --tcp-flags SYN,ACK SYN -j LOG --log-prefix "SSH-IN:" |
catch SYN,FIN and/or SYN,RST packets? It should right because the SYN is set and the ACK is unset everything else is ignored. Right? |
|
| Back to top |
|
|
|
Networking & Security
