Limit SSH access by Country
This is useful when being attack of constant login brute-force attempts mainly from countries like China and Russia. Install GeoLite2 Country Database $ sudo apt-get install geoip-bin Make sure that geoiplookup is working before implementing the script below. $ geoiplookup 8.8.8.8 Create bash script that will filter ssh access by country. $ sudo nano /usr/local/bin/sshfilter.sh #!/bin/bash # UPPERCASE space-separated country codes to ACCEPT ALLOW_COUNTRIES="PH" if [ $# -ne 1 ]; then echo "Usage: `basename $0` <ip>" 1>&2 exit 0 # return true in case of config issue fi COUNTRY=`geoiplookup $1 | awk -F ": " '{ print $2 }' | awk -F "," '{ print $1 }' | head -n 1` [[ $COUNTRY = "IP Address not found" || $ALLOW_COUNTRIES =~ $COUNTRY ]] && RESPONSE="ALLOW" || RESPONSE="DENY" if [ $RESPONSE = "ALLOW" ] then exit 0 else logger "$RESPONSE sshd connection from $1 ($CO...
