Date: Sun, 26 Sep 2004 23:36:39 +0200 From: Willem Jan Withagen <wjw@withagen.nl> To: "David D.W. Downey" <david.downey@gmail.com> Cc: "freebsd-security@FreeBSD.ORG" <freebsd-security@freebsd.org> Subject: Re: Attacks on ssh port Message-ID: <41573667.6080509@withagen.nl> In-Reply-To: <6917b78104092601339f77948@mail.gmail.com> References: <414C2798.7060509@withagen.nl> <6917b781040918103077c76f0c@mail.gmail.com> <20040924214909.GA784@alex.lan> <6917b78104092601339f77948@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
David D.W. Downey wrote:
>On Fri, 24 Sep 2004 23:49:09 +0200, Alex de Kruijff
><freebsd@akruijff.dds.nl> wrote:
>
>
>>>Then you can still see the attempts (and thus log the IP information
>>>for contacting the abuse@ for the responsible IP controller) while
>>>limiting your log sizes.
>>>
>>>
>>This only logs the first tree catches (when the log attribuut is set)
>>per rule. You may want to set this a little higher like 100.
>>
>>
>>
>
>while I agree my example of 3 was low (meant only to instruct) I would
>say more along the lines of 25. if someone is hitting you 25 times in
>a row and getting tagged by that rule, you can bet your butt it's not
>a client of your's.
>
It is even simpler:
Anybody trying to use root as user for ssh-login is not a customer
of mine....
And if he has not figured out that he's doing something wrong after
3 tries, little chance that he is really just making a mistake.
--WjW
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?41573667.6080509>