I've set up some filters on one of my production servers to stop people from trying to brute force in via SSH. Essentially, I'm using iptables to block anyone with 4 failed auth attempts withing 60 seconds. The rules (output from iptables -L) look like:
DROP tcp -- anywhere anywhere tcp dpt:ssh state NEW recent: UPDATE seconds: 60 hit_count: 4 name: DEFAULT side: source tcp -- anywhere anywhere tcp dpt:ssh state NEW recent: SET name: DEFAULT side: source
I'm currently trying to debug one of my clients who is attempting to connect over SFTP, and I would like to confirm that he is NOT on the recent list. Is there a way to view all of the iptables recent list?