<!DOCTYPE html>
<html><head>
<meta charset="UTF-8">
</head><body><p>Hi Jeff<br></p><p>Just an initial thought. Most of the services can be controlled via the service daemons. For example ssh login frequency can be controlled via sshd_config using </p><p>MaxAuthTries <span style="background-color: #ffcc00;">X</span>(number you are happy with) or using MaxStartups<br></p><p>Alternatively, since you are using iptables, an even better approach would be to use iptables with something like:<br></p><p><span style="font-family: Courier New;" face="Courier New">iptables -A INPUT -p tcp --dport <span style="background-color: #ffcc00;">22</span> -m state --state NEW -m recent --update --seconds <span style="background-color: #ffcc00;">X</span> --hitcount <span style="background-color: #ffcc00;">Y</span> --rttl --name <span style="background-color: #ffcc00;">SSH</span> -j DROP</span></p><p><span style="font-family: helvetica,arial,sans-serif;" face="Courier New">Once you have eliminated the basic problem then you could get Suricata to inspect deeper.</span></p><p><span style="font-family: helvetica,arial,sans-serif;" face="Courier New">Hope I didn't just miss the requirement in the first place.</span></p><p><span style="font-family: helvetica,arial,sans-serif;" face="Courier New"><br></span></p><p><span style="font-family: helvetica,arial,sans-serif;" face="Courier New">regards</span></p><p><span style="font-family: helvetica,arial,sans-serif;" face="Courier New">Amar Rathore<br>CounterSnipe - Suricata based IDS/IPS with so much more.<br></span></p><blockquote type="cite">On September 13, 2017 at 3:57 PM Jeff Dyke <jeff.dyke@gmail.com> wrote:<br><br><div dir="ltr">I should have stated that i'm successfully attached to NFQUEUE in inline/IPS mode. <Info> - NFQ running in standard ACCEPT/DROP mode.</div><div class="ox-6cb4c5b248-gmail_extra"><br><div class="ox-6cb4c5b248-gmail_quote">On Wed, Sep 13, 2017 at 3:53 PM, Jeff Dyke <<a href="mailto:jeff.dyke@gmail.com" target="_blank" rel="noopener noreferrer">jeff.dyke@gmail.com</a>> wrote:<br><blockquote><div dir="ltr">i am running an array of servers on aws (EC2 instances), one server in both the staging and production environments has SSH open and 2 have 443/80 open (active/passive HAProxy instances)<div><br></div><div>I've been using OSSEC with active-response to block malicious ssh attacks, and while i like the software and the other things that it finds, I would like to move this type of logic to the edge servers, using suricata. i'll concentrate on SSH for now, from there i can apply my knowledge or other protocols.</div><div><br></div><div>If i'm understanding correctly (likely not) i could add a rate_filter into threshold.conf, or i could add drop rules. What is the best practice in this instance. I know the threshold.config is getting parsed as i see the warning </div><div>[ERRCODE: SC_ERR_EVENT_ENGINE(210)] - signature sid:2019876 has a threshold set. The signature event var is given precedence over the threshold.conf one. Bug #425. <br></div><div><br></div><div>I'm running suricata 4.0.0 RELEASE</div><div><br></div><div>Thanks, for any pointers. If rate_filter is correct, how do i convert it to a drop event when threshold is hit? The docs are great, but i seemed to have missed this piece.</div><div><br></div><div>Jeff</div><div><br></div><div>my 4 threshold.config entries.</div><div><div>rate_filter gen_id 1, sig_id 2019876, track by_rule, count 3, seconds 120, new_action drop, timeout 14400</div><div>rate_filter gen_id 1, sig_id 2101638, track by_rule, count 3, seconds 120, new_action drop, timeout 14400</div><div>rate_filter gen_id 1, sig_id 2001219, track by_rule, count 3, seconds 120, new_action drop, timeout 14400</div><div>rate_filter gen_id 1, sig_id 2006546, track by_rule, count 3, seconds 120, new_action drop, timeout 14400</div><div>suppress gen_id 1, sig_id 2221002, track by_src, ip <a href="http://10.0.0.0/16" target="_blank" rel="noopener noreferrer">10.0.0.0/16</a></div></div><div><br></div><div><br></div></div></blockquote></div><br></div>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br><br>Conference: https://suricon.net<br>Trainings: https://suricata-ids.org/training/</blockquote><p><br></p><div class="io-ox-signature"><p>Kind regards<br></p><p>Amar Rathore</p><p>CounterSnipe Systems LLC <br>Tel: +1 617 701 7213 <br>Mobile: +44 (0) 7876 233333 <br>Skype ID: amarrathore <br>Web: www.countersnipe.com <http://www.countersnipe.com/> <br><br></p><p><span style="font-size: 8pt;">This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system.</span></p><p><span style="font-size: 8pt;">E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. The sender therefore does not accept liability for any errors or omissions.</span> <br></p></div></body></html>