How To Block IP Addresses On Linux Server

July 12th, 2006 by Angsuman Chakraborty

Take a look at your log file (/var/log/secure for Fedora Core 4) and you will discover numerous automated ssh hacking attempts using dictionary attack. So now you have identified the offending addresses. How do you stop them?

Here comes the magic mantra which uses iptables (packet) firewall:

iptables -A INPUT -s a.b.c.d -j DROP

Replace a.b.c.d with the offending IP address. Repeat this for each of the offending IP addresses.

Tags: Computer Security, Headline News, How To, Linux, Open Source Software, Tech Note, Web, Web Hosting, Web Services | | RSS 2.0 | Trackback this Article | Email this Article

You may also like to read

»	How To Add Multiple IP Addresses On Linux / Fedora Core / Fedora
»	WordPress Comment Spamming - Over 50% Contributed by Top 100 IP Addresses
»	Business Trip To USA, Mailing Problems with Translator Plugin Pro etc.
»	Network Security Software Review: Agnitum Outpost Firewall versus ZoneAlarm Personal Firewall
»	How To Find All IP Addresses on Linux
»	How To Implement Round Robin DNS for Load Balancing Servers
»	Comparison of Software RAID on Windows versus Linux
»	Fighting With Linux Server Setup
»	How To: ICMP Ping in Java (JDK 1.5 and above)
»	How To Block MSN & P2P on Linux (Using Shorewall)
»	Overview of Exploits Block List - XBL (Spamhaus.org) in Comment Spam Protection
»	Changing IP's and Adding Servers
»	How To Migrate Mantis Defect Tracking System From Windows To Linux / Fedora Core 6
»	IP Address Changes...
»	Network Masks / Netmasks for Dummies

pastri Says:
August 28th, 2006 at 9:07 am

With even less worries: only allow certain IPs to access SSH. Next to that install “knockd” to allow you to temporarily open up the firewall from the IP you are working on when you are working mobile.

Angsuman Chakraborty Says:
August 28th, 2006 at 9:52 am

I cannot do that as I do not connect from dedicated ip addresses. I connect using a provider (BSNL) who allocated IP’s from a countrywide pool.

IP Guy Says:
December 28th, 2007 at 7:57 am

It’s always good to block service access that are not required for public - for example, SSH.

Detailed Post-Mortem of a Website Hack Through WordPress & How To Protect Your WordPress Blog From Hacking Says:
May 6th, 2008 at 7:47 am

[...] Their website is http://www.kuban.mts.ru/. They appear to be legitimate mobile & internet service provider. Most likely their internet service is being abused by the spammer. Nevertheless I decided to ban this IP address from accessing my server. [...]