Slashdot runs the post on how bots are now trying higher ports for SSH password guessing. This is not a problem for those who do key-based authentication, but for those who have to have password authentication enabled, there is plenty of good advice in the comments to the post. One of the comments provides this handy iptables-based dynamic black list:
iptables --new-chain SSHTHROTTLE iptables --append SSHTHROTTLE --match recent --name bad_actors --update --seconds 86400 --jump DROP iptables --append SSHTHROTTLE --match hashlimit --hashlimit-name ssh_throttle --hashlimit-upto 5/hour --hashlimit-mode srcip --hashlimit-burst 2 --jump ACCEPT iptables --append SSHTHROTTLE --match recent --name bad_actors --set --jump DROP iptables --append INPUT --in-interface ext+ --proto tcp --match conntrack --ctstate NEW --dport 22 --syn --jump SSHTHROTTLE
I haven’t tried it out myself yet, but I’m saving it here for the next time I have a server with password-based authentication SSH.