Better SSH Brute force prevention with iptables

There are countless of 'Howto prevent SSH Brute force attacks with iptables' scattered around the Net. What, in my opinion, is missing from those howtos is a 'holistic' approach to the problem. Only adding a 'recent' rule to iptables is just a part of the solution.

IPTables rule set

Let's take for example the ubiquitous:

# iptables -N IN_SSH

# iptables -A IN_SSH -m recent --name sshbf --rcheck \

              --hitcounts 3 --seconds 10 -j DROP

# iptables -A IN_SSH -m recent --name sshbf --set -j ACCEPT

# iptables -A INPUT -p tcp --dport ssh -m conntrack \

              --ctstate NEW -j IN_SSH

Bash history autocomplete galore

Add the following lines to the end of .bashrc

-----8<-----

# make bash autocomplete with up/down arrow
bind '"\e[A":history-search-backward'
bind '"\e[B":history-search-forward'

# make tab cycle through commands instead of listing
bind '"\t":menu-complete'

----->8-----

Now by pressing arrow up/down bash will autocomplete based on your command line history, while pressing TAB will cycle through commands, directories and files names.