Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote 0 down vote favorite

I've set up some filters on one of my production servers to stop people from trying to brute force in via SSH. Essentially, I'm using iptables to block anyone with 4 failed auth attempts withing 60 seconds. The rules (output from iptables -L) look like:

DROP       tcp  --  anywhere             anywhere            tcp dpt:ssh state NEW recent: UPDATE seconds: 60 hit_count: 4 name: DEFAULT side: source 
           tcp  --  anywhere             anywhere            tcp dpt:ssh state NEW recent: SET name: DEFAULT side: source

I'm currently trying to debug one of my clients who is attempting to connect over SFTP, and I would like to confirm that he is NOT on the recent list. Is there a way to view all of the iptables recent list?

share|improve this question
Did you look in /proc/net/ipt_recent? By the way, this same functionality is provided by the package fail2ban. – pestilence Mar 6 '12 at 19:58
1  
This question appears to be abandoned. Unaccepted answer or unanswered, could you perhaps add more detail to your question? If this question no longer applies then you can either delete it or answer it yourself if you've solved the problem. Flagged for deletion. Thanks! – Ringtail Dec 31 '12 at 14:58

closed as not a real question by Bruno Pereira♦ Jan 3 at 4:30

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

Browse other questions tagged or ask your own question.