<![CDATA[Snort Rule to Block Repeated SSH Attempt?]]>I have an SSH host within my network that needs to be exposed to the Internet for legitimate purposes. Unfortunately using public-key auth or changing the SSH port to non-standard isn't an option right now. The passwords are secure, but I'm looking to stop the repeated dictionary attacks using a Snort rule.

I was surprised a Snort rule didn't already seem to exist to block x number of attempts from IP y in a timeframe z.

I haven't ever written Snort rules… does anyone have any idea how such a rule would be written?

Thanks!

]]>https://forum.netgate.com/topic/44560/snort-rule-to-block-repeated-ssh-attemptRSS for NodeTue, 14 Jul 2026 22:02:38 GMTWed, 02 May 2012 12:43:22 GMT60<![CDATA[Reply to Snort Rule to Block Repeated SSH Attempt? on Thu, 03 May 2012 03:00:56 GMT]]>If you create a wan rule and limit the number o connections per second. If external ip exceeds the value you defined, it will be blocked for about 02 hours by pfsense.
You can check blocked ips on diagnosts -> tables.

]]>https://forum.netgate.com/post/334328https://forum.netgate.com/post/334328Thu, 03 May 2012 03:00:56 GMT<![CDATA[Reply to Snort Rule to Block Repeated SSH Attempt? on Thu, 03 May 2012 02:42:03 GMT]]>So I did find a rule in emerging-scan.rules, but it wasn't catching these particular dictionary attacks. I modified it to remove the requirements of the SYN and both reserved TCP flags, and to lower the threshold from 5 attempts in 60 seconds to 3 attempts in 300 seconds. We'll see if it works tomorrow. :)

]]>https://forum.netgate.com/post/334324https://forum.netgate.com/post/334324Thu, 03 May 2012 02:42:03 GMT