Re: [Nolug] blocking SSH

"Petri Laihonen" <pietu@weblizards.net> writes:

> Is there a way to completely block access to the server from the offending
> IP, lets say..... after 3 authentication failures?

I don't know of a tool that will do this, but I've been thinking of
writing a tool that will watch logfiles and block IP addresses when
it sees suspicious activity. For example, I'm getting these root
probes on ssh as well as regular probes on Apache for FrontPage
vulnerabilities and the like.

It'd be nice to block IPs that generate these probes. I use
portsentry for un-used ports, but it is no good on used ports.

Mark.

-- 
A choice between one man and a shovel, or a dozen men with teaspoons
is clear to me, and I'm sure it is clear to you also.
    -- Zimran Ahmed <http://www.winterspeak.com/>

___________________
Nolug mailing list
nolug@nolug.org