I am investigating methods to slow down the rate at which attackers can make brute force attempts against my webserver's SSH and HTTP services.
I have come across many articles as well as the iptables-extensions
man page which suggest limiting the number of parallel connections an IP address can make, using rules like
iptables -A INPUT -p tcp -syn -m multiport --dport 80,443 -m connlimit --connlimit-above 20 -j REJECT
Which will only allow 20 connections per IP at any given time.
Given that the HTTP 1.1 and HTTP 2.0 (not sure about SSH) protocols support tcp multiplexing and that by default webservers like Apache will keep idle TCP connections active with KeepAlive
directive, I would have thought a bruteforce tool would only need to establish a low number of connections and those connections could support many repeated requests and responses over a long period of time
e.g. a browser might only need 6-8 connections at any given time yet those connections will support many HTTP request/responses.
- Does anyone know from experience how many parallel TCP connections a brute force tool will try and open?
- and also are rate limiting firewall rules like this effective?