Bug 104602

The module seems to be more versatile than it's name suggests. I'll investige 
whether it's worth integrating it. I fear it will be too complicated for the 
simple config file syntax of SuSEfirewall2. 

What about a config option to limit the number of connections per port per IP?

    MAX_CONNECT_PER_MINUTE="ssh:4:300 pop3:10:60"
                            ^^^ ^ ^^^
                     port <--'  |  '---> block time (in seconds)
                                '--> allowed (new) connections per minute

I have seen many mailinglist posts where people do something like that using custom rules, so this currently seems to be the main usage of ipt_recent.

One example of the used custom rules:

fw_custom_after_antispoofing() {
    iptables -A input_ext -p tcp --dport 22 -m recent --update --seconds 300
--hitcount 4 --rttl --name SSH -j LOG --log-prefix "SSH_brute_force "
    iptables -A input_ext -p tcp --dport 22 -m recent --update --seconds 300
--hitcount 4 --rttl --name SSH -j DROP
    iptables -A input_ext -p tcp --dport 22 -m state --state NEW -m recent
--set --name SSH -j ACCEPT
    true
}

I understand that SUSEfirewall probably can't support all features of ipt_recent - but why not support at least the most prominent ones? ;-)

Ping ;-)

Ludwig, what do you think about my suggestion from comment #2?

I'm not sure what's the best method to support this. We could either introduce a new variable or extend an existing one. Something like FW_SERVICES_ACCEPT_EXT="0/0,22,tcp,ipt_recent=4:300" or
FW_SERVICES_ACCEPT_EXT="0/0,22,tcp,hitcount=4,blockseconds=300"

(In reply to comment #4)
> FW_SERVICES_ACCEPT_EXT="0/0,22,tcp,hitcount=4,blockseconds=300"

This sounds like a good idea and is even better than introducing another config option somewhere[tm] in the config file :-)

However, I'm not really happy with the wording "hitcount" - it should reflect the meaning better: max. number of new connections per second.
What about "maxconnect"?

"blockseconds" sounds good, BTW.

the ipt_recent option is called --hitcount so it can't be that wrong :)

OK, that's a very good argument ;-)

Since this was the only thing I initially disliked in your idea
> FW_SERVICES_ACCEPT_EXT="0/0,22,tcp,hitcount=4,blockseconds=300"
feel free to implement this ;-)

done

Thanks!

VERIFIED in 10.2

For the records: the syntax differs to the example above. Working example  from /usr/share/doc/packages/SuSEfirewall2/SuSEfirewall2.sysconfig:
FW_SERVICES_ACCEPT_EXT="0/0,tcp,22,,hitcount=3,blockseconds=60,recentname=ssh"