From: Robin Atwood <robin.atwood@attglobal.net>
To: gentoo-user@lists.gentoo.org
Subject: Re: [gentoo-user] Re: Why isn't sshd blocking repeated failed login attempts?
Date: Thu, 22 Jan 2009 19:06:30 +0700 [thread overview]
Message-ID: <200901221906.30369.robin.atwood@attglobal.net> (raw)
In-Reply-To: <58965d8a0901211449x5da42120ib8a8087d97ebce70@mail.gmail.com>
On Thursday 22 Jan 2009, Paul Hartman wrote:
> On Wed, Jan 21, 2009 at 11:53 AM, Nikos Chantziaras <realnc@arcor.de> wrote:
> Jan 21 14:35:43 [sshd] Invalid user murray from 203.110.208.68
>
>
> So, 11 attempts in the first minute of activity (and it picked up
> pace, later on attempting every 2 seconds). Surely denyhosts should
> have blocked it already at that point based on my settings, correct?
Your regex's might not be up to snuff. Try adding the one below to
denyhosts.conf:
USERDEF_FAILED_ENTRY_REGEX=Invalid user (?P<user>.*) .*from (::ffff:)?
(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
HTH
-Robin
--
next prev parent reply other threads:[~2009-01-22 12:06 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-01-20 21:33 [gentoo-user] Why isn't sshd blocking repeated failed login attempts? Paul Hartman
2009-01-20 21:47 ` Etaoin Shrdlu
2009-01-22 13:40 ` Guillermo Garron
2009-01-20 21:49 ` Joshua Murphy
2009-01-20 21:54 ` Paul Hartman
2009-01-21 12:36 ` [gentoo-user] " Nikos Chantziaras
2009-01-21 14:35 ` Paul Hartman
2009-01-21 14:56 ` Neil Bothwick
2009-01-21 17:53 ` Nikos Chantziaras
2009-01-21 22:49 ` Paul Hartman
2009-01-22 8:31 ` Mick
2009-01-22 12:06 ` Robin Atwood [this message]
2009-01-22 16:06 ` Nikos Chantziaras
2009-01-22 16:18 ` Paul Hartman
2009-01-22 16:37 ` James Homuth
2009-01-22 16:46 ` Paul Hartman
2009-01-23 18:26 ` Mick
2009-01-23 20:22 ` Paul Hartman
2009-01-23 21:18 ` Paul Hartman
2009-01-23 21:34 ` Paul Hartman
2009-01-26 20:10 ` Paul Hartman
-- strict thread matches above, loose matches on Subject: below --
2009-01-23 20:33 Alan McKinnon
2009-01-23 20:54 ` Paul Hartman
2009-01-23 21:00 ` Alan McKinnon
2009-01-24 15:09 ` Steven Lembark
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200901221906.30369.robin.atwood@attglobal.net \
--to=robin.atwood@attglobal.net \
--cc=gentoo-user@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox