Re: [gentoo-user] Re: Why isn't sshd blocking repeated failed login attempts?

[Paul Hartman <paul.hartman+gentoo@gmail.com>]

On Thu, Jan 22, 2009 at 10:37 AM, James Homuth <james@the-jdh.com> wrote:
>
>
> -----Original Message-----
> From: news [mailto:news@ger.gmane.org] On Behalf Of Nikos Chantziaras
> Sent: January 22, 2009 11:07 AM
> To: gentoo-user@lists.gentoo.org
> Subject: [gentoo-user] Re: Why isn't sshd blocking repeated failed login
> attempts?
>
> Paul Hartman wrote:
>> On Wed, Jan 21, 2009 at 11:53 AM, Nikos Chantziaras <realnc@arcor.de>
> wrote:
>>> Can you check the logs to see the timespan in which those hundreds of
>>> attempts took place?  Also, what's the time interval Denyhosts checks
>>> for login attempts?
>>
>> The most recently denied host from this afternoon made over 200 login
>> attempts in a span of 17 minutes before denyhosts caught it. In my
>> denyhosts.conf I have these:
>>
>> DENY_THRESHOLD_INVALID = 3
>> DENY_THRESHOLD_VALID = 3
>> DENY_THRESHOLD_ROOT = 1
>> DENY_THRESHOLD_RESTRICTED = 1
>
> What is the value of DAEMON_SLEEP?
>
>
> Denyhosts doesn't pick up on certain types of PAM auth regular expressions.
> If any of those appear in your logs during those 200+ attempts, Denyhosts is
> probably not reading them. I've already reported it
> (http://bugs.gentoo.org/show_bug.cgi?id=248047) if you want to add anything
> to it.

I don't use PAM in sshd so I don't think that's my problem, but the
whole regexp thing is a possiblity in general as someone else
suggested. I will check into it tonight after work.

Thanks,

Paul