I see a link on blocking remote access Blocking Remote Login, which sets #ListenAddress in /etc/ssh/sshd_config.

But I would like to block a bunch of IPs, such as those listed in http://www.websworld.org/, if there a simple way to do this blocking without having to change setting frequently?

Moreover, is there a way to only allow remote login from specified IPs? (say, any login try from br, cn, in, etc domains would be blocked). I see some instructions on using fail2ban, but it seems such changes need to be done quite frequently, such as daily? (I may see it wrong, would appreciate any enlightenment.)

Thank you.


Fail2ban blocks IPs based on specified parameters (such as attempts). It does so automatically. You can also set it up to email you when it does so. You can find a nice setup guide here. It is for Debian Wheezy, but it should work for Ubuntu. As far as banning IP addresses, you can do it using this command:

iptables -A INPUT -s IP-ADDRESS -j DROP

For example, to block (the first one listed on websworld when I checked it):

iptables -A INPUT -s -j DROP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.