0

I'm running a VPS (under ArchLinux) and was wondering if sshguard was useful in the following case.

My iptables rule for SSH in looks like this :

iptables -A INPUT -p tcp --source $Trusted --dport 22 -j ACCEPT

with $Trusted a set of Trusted IPs, currently only my VPN IP. Basically iptables deny all and then accept only what I need.

I had a look at sshguard and it requires to create an iptables chain and then use :

iptables -A INPUT -p tcp --dport 22 -j sshguard

I'm asking that question because to me it looks like adding this rule opens up ssh more than it is with an IP restriction.

Should I use sshguard normally or only use the following rule in case my Trusted IP has been spoofed ?

iptables -A INPUT -p tcp --source $Trusted --dport 22 -j sshguard

Thanks !

  • you can't spoof an IP and still maintain communication - spoofing only works if you don't care to establish a channel of communication – schroeder Apr 5 '15 at 21:49
  • I don't understand your point. I once opened a question and someone told me 'IP can be spoofed too' while talking about IP authentication. So, Ip restriction should be enough untill someone spoof my IP. Should I enabled sshguard for that particular case ? – Lich4r Apr 6 '15 at 19:43
  • If you spoof an IP, then the response goes to the spoofed IP, not to the attacker's IP. Spoofing an IP is useful for DoS attacks, but not if you are establishing communication, which authentication requires. – schroeder Apr 6 '15 at 19:45
  • So an attacker can't spoof my IP in order to connect to my server using SSH ? – Lich4r Apr 6 '15 at 19:48
  • no they can't - the danger you face is if you legitimately change your IP (ISP IP re-assignment, etc.) – schroeder Apr 6 '15 at 19:49
2

sshguard is useful when you can't whitelist connections, but you can, so it's not going to protect you to any greater degree than a simple whitelist.

sshguard is most useful when you cannot predict what IPs might legitimately connect to your service, so you use it to cut off any bad actors. FAQ

You don't have to worry about "IP Spoofing" because an attacker cannot spoof your IP and still be able to establish a connection. IP Spoofing is a threat in DoS scenarios, not in authentication scenarios.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.