I’m beginning to think I need to set up a Wiki for this stuff.. but later.

I’ve been trying to get sshdfilter up and running on my new Debian box, and of course I didn’t document the process when I did it on 3 previous machines awhile back, so here goes.

1. Install sshdfilter script in /usr/local/sbin
2. Edit /etc/init.d/ssh. Look for two lines that look something like
   
   

   
   start-stop-daemon --start [...] /usr/sbin/sshd -- $SSHD_OPTS
   

   
   

   Replace them with

   
   

   
   start-stop-daemon --start --quiet --exec /usr/local/sbin/sshdfilter -- $SSHD_OPTS &
   

   
   

   Don’t forget the trailing ampersand!
   

3. Create an executable file /usr/local/etc/iptables.sh:
   
   

   
   

#!/bin/sh

modprobe ip_tables

iptables -N SSHD

iptables -A INPUT -p tcp -m tcp --dport 22 -j SSHD

exit 0


   

   
   
4. Modify /etc/network/interfaces. Under interface eth0, add the following line:
   
   

   pre-up /usr/local/etc/iptables.sh

   
   

And that should do it.