I'm also thinking that the last line (well. after you accept established connections really) should be along the lines of:
Code:
 $ipt -I INPUT -p tcp -m recent --name ssh_knock --remove

Otherwise all I need to do is portscan and then ssh in...

Also see http://www.debian-administration.org/articles/268 for a multi-port knock using ipt_recent
(Which also -I think - has the failing that multiple portscans will open the hole)


Edited by LittleBlueThing (04/12/2008 18:39)
_________________________
LittleBlueThing Running twin 30's