[SOLVED] Port Forwarding question regarding security.

djsigmann · 04-14-2019, 09:00 AM

So, This may be the incorrect place to post this, if it is please let me know.

Basically, I am new to Linux in general and am unsure about many things.

To cut it short, I want to open port 22 to a machine on my network, not for ssh access, but to monitor and record login attempts by other people (using iptables or something).

Would this be safe? Advised? Nonsensical? Why or why not?

Any helpful responses will be greatly appreciated, thanks in advance.

TB0ne · 04-14-2019, 09:38 AM

Quote:

Originally Posted by djsigmann

[FONT="Arial"]So, This may be the incorrect place to post this, if it is please let me know.
Basically, I am new to Linux in general and am unsure about many things.

To cut it short, I want to open port 22 to a machine on my network, not for ssh access, but to monitor and record login attempts by other people (using iptables or something). Would this be safe? Advised? Nonsensical? Why or why not?

Linux doesn't have much to do with this, in all honesty. What you're talking about is basic network security, and for that you'd be better off with a real network security solution. IDS systems like Snort exist to do this very thing, and generate useful data from attempts.

thinknix · 04-14-2019, 09:55 AM

You may also want to look into setting up a network honeypot, which would fool attackers into thinking they had compromised a server and record what they did afterwards. Apart from the research aspect (which you may be interested in so I don't want to discourage you), you're likely to be disappointed if you just setup, say an iptables firewall that drops and logs all port 22 login attempts. On any server connected to the internet with port 22 open, you will see brute-force login attempts in your logs all day, every day.