Date: Wed, 26 Jan 2005 08:57:33 -0800 From: Sandy Rutherford <sandy@krvarr.bc.ca> To: Christian Tischler <mail@myunix.net> Cc: FreeBSD Questions <freebsd-questions@freebsd.org> Subject: Re: Banning ips for some time? Message-ID: <16887.52221.648112.336027@szamoca.krvarr.bc.ca> In-Reply-To: <41F60ECC.8050206@myunix.net> References: <41F60ECC.8050206@myunix.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Christian, On Tue, 25 Jan 2005 you wrote: > .... my servers sshd reports 30 to 50 failed > root/operator/etc. logins a day. I would like to block the incoming ip > for a few days automaticly after e.g failed login requests. > Currently I am using ipf, but it would be no problem to use any other > FreeBSD firewall. For peace of mind, you can always use the AllowGroups, AllowUsers, PermitRootLogin, .... options in sshd_config to remove ssh access to root, uucp, operator, and other system accounts. I only permit ssh access to user accounts. The scripts which are making these login attempts are not typically going to try user accounts for obvious reasons. If you need off-site root access you should be using su or sudo bash anyway. I would recommend always turning off root access via ssh. ...Sandy
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?16887.52221.648112.336027>