MK0-201 · Question #247
One of your clients has been the victim of a brute force attack against their SSH server. They ask you what could be done to protect their Linux servers. You propose the use of IPTables (the built…
The correct answer is C. iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --. See the full explanation below for the reasoning.
Question
One of your clients has been the victim of a brute force attack against their SSH server. They ask you what could be done to protect their Linux servers. You propose the use of IPTables (the built in kernel firewall) to limit connection attempts to protect their servers. You agree with your client to limit connections to the SSH port to a maximum of only three trials per minutes considering there is only one administrator who has a valid need to connect remotely onto this port. If the threshold of three connections is exceeded, the attacker will have to wait for another 60 seconds before it will resume allowing connections again. Which of the following IPTables entry would meet your clients needs?
Options
- Aiptables -A INPUT -p tcp --dport 23 -m state --state NEW -m recent --update --seconds 60 --
- Biptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --
- Ciptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --
- Diptables -A OUTPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --
How the community answered
(19 responses)- B11% (2)
- C84% (16)
- D5% (1)
Community Discussion
No community discussion yet for this question.