From: "Paul Hartman" <paul.hartman+gentoo@gmail.com>
To: gentoo-user@lists.gentoo.org
Subject: Re: [gentoo-user] Re: Curious pattern in log files from ssh...
Date: Wed, 3 Dec 2008 14:19:14 -0600 [thread overview]
Message-ID: <58965d8a0812031219p60983e40p7b4beb7539835c70@mail.gmail.com> (raw)
In-Reply-To: <gh6pef$kvp$1@ger.gmane.org>
On Wed, Dec 3, 2008 at 2:16 PM, Nikos Chantziaras <realnc@arcor.de> wrote:
> Steve wrote:
>>
>> [...]
>> Sure, I could use IPtables to block all these bad ports... or... I could
>> disable password authentication entirely... but I keep thinking that
>> there has to be something better I can do... any suggestions?
>
> I'm using DenyHosts to battle this. It adds the IPs to /etc/hosts.deny
> after a configurable amount of failed logins. It even downloads an online
> list of IPs where attacks originate from and uploads attacks to your box to
> this list too (if you allow it in the configuration).
>
> After I installed this, no more brute-forcing :) I used to have thousands
> per day.
>
> http://www.denyhosts.net
>
> It's in portage.
The big botnet attacks are doing no more than 2 login attempts per IP,
making stuff like denyhosts hard to use (unless you set it to ban
after 1 login attempt, but that'll catch real users who make a typo)
next prev parent reply other threads:[~2008-12-03 20:20 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-12-03 20:02 [gentoo-user] Curious pattern in log files from ssh Steve
2008-12-03 20:16 ` [gentoo-user] " Nikos Chantziaras
2008-12-03 20:19 ` Paul Hartman [this message]
2008-12-03 20:52 ` Nikos Chantziaras
2008-12-03 20:17 ` [gentoo-user] " Albert Hopkins
2008-12-03 20:18 ` Paul Hartman
2008-12-03 20:49 ` Simon
2008-12-04 11:31 ` Steve
2008-12-05 7:16 ` Mick
2008-12-03 20:54 ` Alan McKinnon
2008-12-03 21:03 ` Dmitry S. Makovey
2008-12-03 21:47 ` Steve
2008-12-03 22:11 ` Dmitry S. Makovey
2008-12-03 22:55 ` Steve
2008-12-03 23:21 ` Paul Hartman
2008-12-03 23:46 ` Dmitry S. Makovey
2008-12-03 23:55 ` Steve
2008-12-04 0:07 ` Dmitry S. Makovey
2008-12-04 0:39 ` Steve
2008-12-04 15:50 ` Dmitry S. Makovey
2008-12-04 22:44 ` Adam Carter
2008-12-05 0:15 ` Dmitry S. Makovey
2008-12-04 23:42 ` Shawn Haggett
2008-12-03 22:54 ` Adam Carter
2008-12-04 11:24 ` Evgeniy Bushkov
2008-12-04 22:41 ` Adam Carter
2008-12-04 22:53 ` Adam Carter
2008-12-05 15:05 ` Evgeniy Bushkov
2008-12-07 5:52 ` Joshua Murphy
2008-12-04 19:03 ` Christian Franke
2008-12-04 20:22 ` Dmitry S. Makovey
2008-12-04 21:20 ` Alan McKinnon
2008-12-05 11:24 ` Steve
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=58965d8a0812031219p60983e40p7b4beb7539835c70@mail.gmail.com \
--to=paul.hartman+gentoo@gmail.com \
--cc=gentoo-user@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox