Possibly you mean brute-force attacks? I find fail2ban useful for this sort of thing, since this is not exclusively a firewall issue:
http://en.wikipedia.org/wiki/Fail2ban That said I haven't ever crossed this with a puppet-managed firewall. On Tue, May 12, 2015 at 02:17:59PM +0000, Peter Berghold wrote: > Hey folks, > I'm trying to figure out how to code rules in puppetlabs-firewall to > mitigate Brew Force Attacks (BFA) and can't figure out how to code it. > Here is the pattern I'm trying to code: > > $ sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m > recent --set --name SSH > $ sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m > recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP > > Looking at the source code for the type and provider would lead me to belive > that all the pieces are their but who to assemble them I haven't been able to > guess at. > > Thanks in advance. > > -- > You received this message because you are subscribed to the Google Groups > "Puppet Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [1]puppet-users+unsubscr...@googlegroups.com. > To view this discussion on the web visit > > [2]https://groups.google.com/d/msgid/puppet-users/CAArvnv15UB7JPDdVQVHZyRP%2BW30H1CHahD-KaV%3DSm5w0i7CN-Q%40mail.gmail.com. > For more options, visit [3]https://groups.google.com/d/optout. > > References > > Visible links > 1. mailto:puppet-users+unsubscr...@googlegroups.com > 2. > https://groups.google.com/d/msgid/puppet-users/CAArvnv15UB7JPDdVQVHZyRP%2BW30H1CHahD-KaV%3DSm5w0i7CN-Q%40mail.gmail.com?utm_medium=email&utm_source=footer > 3. https://groups.google.com/d/optout -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/20150512143018.GA27324%40iniquitous.heresiarch.ca. For more options, visit https://groups.google.com/d/optout.
