# $Header: /global/src/etc/cl-manage-scripts/patches/RCS/P-iptables-recent-ssh-F9,v 1.1 2008/02/20 08:29:14 pb22 Exp $
# patch to allow at most 3 incoming ssh calls per 80s from outside the Lab
# patch-file matches : name.SSH
# patch-file distmatches = Fedora.release.[89]
# Process using /usr/bin/cl-patch-file unless matching the above
--- /etc/sysconfig/iptables	2007-05-27 13:13:17.000000000 +0100
+++ /etc/sysconfig/iptables	2007-05-27 12:47:56.000000000 +0100
@@ -10 +10,6 @@
--A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
+#5 Allow ssh from within the Lab, but block repeated calls from outside (i.e. 3 / 80s)
+-A INPUT -m state --state NEW -m tcp -p tcp -s 128.232.0.0/17 --dport 22 -j ACCEPT
+-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --rcheck --seconds 80 --hitcount 3 --name SSH --rsource -j LOG -m limit --limit 10/sec --log-prefix "ipt: recent SSH DROP "
+-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --update --seconds 80 --hitcount 3 --name SSH --rsource -j DROP
+-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --rcheck --seconds 80 --hitcount 1 --name SSH --rsource -j LOG -m limit --limit 10/sec --log-prefix "ipt: recent SSH count "
+-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -m recent --set --name SSH --rsource -j ACCEPT
