From: Adam Carter <Adam.Carter@optus.com.au>
To: "gentoo-user@lists.gentoo.org" <gentoo-user@lists.gentoo.org>
Subject: RE: [gentoo-user] Curious pattern in log files from ssh...
Date: Thu, 4 Dec 2008 09:54:14 +1100 [thread overview]
Message-ID: <5602B0BD6D59AE4791BE83104940118D3BD1CF05@excprdmbxw002.optus.com.au> (raw)
In-Reply-To: <4936FE82.9070509@shic.co.uk>
> I previously used denyhosts - but (I can't remember why) it became
> preferable to block with IPtables rather than with
> tcpwrappers... which
> prompted me to dump it in favour of a bespoke script based upon
> blacklist.py (http://blinkeye.ch/mediawiki/index.php/SSH_Blocking) -
> though, now, I'm tempted by the more professional looking sshguard -
> thanks for the tip. Of course, this doesn't really address
> the problem
> I posted about - because I'm now faced with a highly distributed
> dictionary attack...
Fail2ban is iptables based. From the website it now appears to have a map feature so if say you notice most of the attacks coming from China, and none of you ssh useres are in China, you could perhaps block the entire country with http://people.netfilter.org/~peejix/geoip/howto/geoip-HOWTO.html
next prev parent reply other threads:[~2008-12-03 22:53 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-12-03 20:02 [gentoo-user] Curious pattern in log files from ssh Steve
2008-12-03 20:16 ` [gentoo-user] " Nikos Chantziaras
2008-12-03 20:19 ` Paul Hartman
2008-12-03 20:52 ` Nikos Chantziaras
2008-12-03 20:17 ` [gentoo-user] " Albert Hopkins
2008-12-03 20:18 ` Paul Hartman
2008-12-03 20:49 ` Simon
2008-12-04 11:31 ` Steve
2008-12-05 7:16 ` Mick
2008-12-03 20:54 ` Alan McKinnon
2008-12-03 21:03 ` Dmitry S. Makovey
2008-12-03 21:47 ` Steve
2008-12-03 22:11 ` Dmitry S. Makovey
2008-12-03 22:55 ` Steve
2008-12-03 23:21 ` Paul Hartman
2008-12-03 23:46 ` Dmitry S. Makovey
2008-12-03 23:55 ` Steve
2008-12-04 0:07 ` Dmitry S. Makovey
2008-12-04 0:39 ` Steve
2008-12-04 15:50 ` Dmitry S. Makovey
2008-12-04 22:44 ` Adam Carter
2008-12-05 0:15 ` Dmitry S. Makovey
2008-12-04 23:42 ` Shawn Haggett
2008-12-03 22:54 ` Adam Carter [this message]
2008-12-04 11:24 ` Evgeniy Bushkov
2008-12-04 22:41 ` Adam Carter
2008-12-04 22:53 ` Adam Carter
2008-12-05 15:05 ` Evgeniy Bushkov
2008-12-07 5:52 ` Joshua Murphy
2008-12-04 19:03 ` Christian Franke
2008-12-04 20:22 ` Dmitry S. Makovey
2008-12-04 21:20 ` Alan McKinnon
2008-12-05 11:24 ` Steve
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5602B0BD6D59AE4791BE83104940118D3BD1CF05@excprdmbxw002.optus.com.au \
--to=adam.carter@optus.com.au \
--cc=gentoo-user@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox