IP tables basically..
you might be better served to install a firewall that wraps the IPTables and has a very easy interface..
CSF firewall.. also handles the brute force crap that is inevitable on ANY server on the NET...
lots of things can be done.. ie: change your SSH port from 22 to a non standard... don't allow root SSH at all.. make them 'su' after login... and much more
i have the firewall automatically ban 'bad guys' and email me about it... makes for major peace of mind..
here's a typical example...
Time: Wed Feb 10 20:25:46 2010 -0800
IP: 140.123.1.12 (TW/Taiwan Province of China/dns6.ccu.edu.tw)
Hits: 11
Blocked: Temporary Block
Sample of block hits:
Feb 10 20:24:16 server kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=00:16:76:c2:8f:9e:00:17:df:8d:64:0a:08:00 SRC=140.123.1.12 DST=74.50.5.2 LEN=194 TOS=0x00 PREC=0x00 TTL=56 ID=57140 PROTO=UDP SPT=53 DPT=40421 LEN=174 Feb 10 20:24:16 server kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=00:16:76:c2:8f:9e:00:17:df:8d:64:0a:08:00 SRC=140.123.1.12 DST=74.50.5.2 LEN=194 TOS=0x00 PREC=0x00 TTL=56 ID=57141 PROTO=UDP SPT=53 DPT=40421 LEN=174 Feb 10 20:24:18 server kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=00:16:76:c2:8f:9e:00:17:df:8d:64:0a:08:00 SRC=140.123.1.12 DST=74.50.5.2 LEN=153 TOS=0x00 PREC=0x00 TTL=56 ID=57202 PROTO=UDP SPT=53 DPT=40421 LEN=133 Feb 10 20:24:21 server kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=00:16:76:c2:8f:9e:00:17:df:8d:64:0a:08:00 SRC=140.123.1.12 DST=74.50.5.2 LEN=238 TOS=0x00 PREC=0x00 TTL=56 ID=57310 PROTO=UDP SPT=53 DPT=40421 LEN=218 Feb 10 20:24:21 server kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=00:16:76:c2:8f:9e:00:17:df:8d:64:0a:08:00 SRC=140.123.1.12 DST=74.50.5.2 LEN=420 TOS=0x00 PREC=0x00 TTL=56 ID=57311 PROTO=UDP SPT=53 DPT=40421 LEN=400 Feb 10 20:24:22 server kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=00:16:76:c2:8f:9e:00:17:df:8d:64:0a:08:00 SRC=140.123.1.12 DST=74.50.5.2 LEN=153 TOS=0x00 PREC=0x00 TTL=56 ID=57341 PROTO=UDP SPT=53 DPT=40421 LEN=133 Feb 10 20:24:23 server kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=00:16:76:c2:8f:9e:00:17:df:8d:64:0a:08:00 SRC=140.123.1.12 DST=74.50.5.2 LEN=238 TOS=0x00 PREC=0x00 TTL=56 ID=57362 PROTO=UDP SPT=53 DPT=40421 LEN=218 Feb 10 20:24:23 server kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=00:16:76:c2:8f:9e:00:17:df:8d:64:0a:08:00 SRC=140.123.1.12 DST=74.50.5.2 LEN=420 TOS=0x00 PREC=0x00 TTL=56 ID=57371 PROTO=UDP SPT=53 DPT=40421 LEN=400 Feb 10 20:24:25 server kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=00:16:76:c2:8f:9e:00:17:df:8d:64:0a:08:00 SRC=140.123.1.12 DST=74.50.5.2 LEN=238 TOS=0x00 PREC=0x00 TTL=56 ID=57405 PROTO=UDP SPT=53 DPT=40421 LEN=218 Feb 10 20:24:33 server kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=00:16:76:c2:8f:9e:00:17:df:8d:64:0a:08:00 SRC=140.123.1.12 DST=74.50.5.2 LEN=227 TOS=0x00 PREC=0x00 TTL=56 ID=57580 PROTO=UDP SPT=53 DPT=40421 LEN=207 Feb 10 20:24:49 server kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT= MAC=00:16:76:c2:8f:9e:00:17:df:8d:64:0a:08:00 SRC=140.123.1.12 DST=74.50.5.2 LEN=227 TOS=0x00 PREC=0x00 TTL=56 ID=57976 PROTO=UDP SPT=53 DPT=40421 LEN=207
I usually have taiwan, china and ukraine dudes running automated scanners and most servers have the same.. just have a good security setup... STRONG passwords and you'll be fine
