# $Header: /global/src/etc/cl-manage-scripts/patches/RCS/P-iptables-recent-ssh,v 1.6 2025/03/21 15:19:26 mas90 Exp $
# patch to allow at most 3 incoming ssh calls per 80s from outside the Lab
# patch-file matches : name.SSH
# patch-file distmatches = Fedora.Core.release.[56]|Fedora.release.[78]|CentOS.release.5|Red.Hat.Enterprise.Linux
# Process using /usr/bin/cl-patch-file unless matching the above
--- /etc/sysconfig/iptables	2007-05-27 13:13:17.000000000 +0100
+++ /etc/sysconfig/iptables	2007-05-27 12:47:56.000000000 +0100
@@ -18 +18,6 @@
--A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
+#5 Allow ssh from within the Lab, but block repeated calls from outside (i.e. 3 / 80s)
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -s 128.232.0.0/17 --dport 22 -j ACCEPT
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --rcheck --seconds 80 --hitcount 3 --name SSH --rsource -j LOG -m limit --limit 10/sec --log-prefix "ipt: recent SSH DROP "
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --update --seconds 80 --hitcount 3 --name SSH --rsource -j DROP
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --rcheck --seconds 80 --hitcount 1 --name SSH --rsource -j LOG -m limit --limit 10/sec --log-prefix "ipt: recent SSH count "
+-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --set --name SSH --rsource -j ACCEPT
