Re: [gentoo-user] Re: SSH brute force attacks and blacklist.py

[Willie Wong <wwong@Princeton.EDU>]

On Thu, Feb 28, 2008 at 11:13:10AM +0000, Penguin Lover Steve squawked:
> Thanks for all your suggestions...
> 
> I will look into fail2ban... that might be what I need...  While I could 
> crank BLOCKING_PERIOD for blacklist.py to an absurdly high value, this 
> (AFAIK) will not persist blocks when the server is powered down or rebooted.

Hum, that is interesting. I haven't played with blacklist.py, but if
it runs on top of iptables, the iptables init script *should* save the
current config when powering down. I sort of depended on that when I
cobbled together a perl script 2 years ago to parse the sshd log and 
ban sites using iptables.

Also, I would not suggest banning forever. I started with the same
mentality as you and coded as such. I switched quickly to banning for
1 hour when once, due to not noticing the caps-lock light, I banned my
work computer completely... After switching to the 1 hour ban, I did a
small experiment and saved about 2 months worth of logs. Not a single
ip address has been banned more than once (but there were several /24
in Korea, Taiwan, and Mexico that have many ip addresses banned).
Based on this, I don't think it is strictly necessary to ban forever.

Just my 2 cents.

W
-- 
Santa's helpers are subordinate clauses.
Sortir en Pantoufles: up 447 days, 14:37
-- 
gentoo-user@lists.gentoo.org mailing list