# $Header: /global/src/etc/cl-manage-scripts/patches/RCS/P-ip6tables-recent-ssh,v 1.2 2010/10/21 05:32:49 pb22 Exp $
# patch to allow at most 3 incoming ssh calls per 80s from outside the Lab
# patch-file matches : name.SSH
# patch-file ~istmatches = Fedora|CentOS|Red.Hat.Enterprise.Linux
# patch-file distmatches = NONE_YET
# Process using /usr/bin/cl-patch-file unless matching the above
--- /etc/sysconfig/ip6tables	2008-03-06 06:16:46.000000000 +0000
+++ /etc/sysconfig/ip6tables	2008-03-06 06:22:12.000000000 +0000
@@ -19,6 +19,10 @@
 #A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
--A RH-Firewall-1-INPUT -m tcp -p tcp --dport 22 -j ACCEPT
-#1 cl.cam.ac.uk: we do not understand why the default allows *src* port 22
 #1 cl.cam.ac.uk: allow ESTABLISHED calls - amazingly the default appears not to!
 -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+#5 Allow ssh from within the Lab, but block repeated calls from outside (i.e. 3 / 80s)
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s 2001:630:200:4570::/64 --dport 22 -j ACCEPT
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --rcheck --seconds 80 --hitcount 3 --name SSH --rsource -j LOG -m limit --limit 10/sec --log-prefix "ipt: recent SSH DROP "
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --update --seconds 80 --hitcount 3 --name SSH --rsource -j DROP
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --rcheck --seconds 80 --hitcount 1 --name SSH --rsource -j LOG -m limit --limit 10/sec --log-prefix "ipt: recent SSH count "
+#1 cl.cam.ac.uk: we do not understand why the default allows *src* port 22
 #A RH-Firewall-1-INPUT -m tcp -p tcp --sport 22 -j ACCEPT
