From owner-freebsd-questions@FreeBSD.ORG  Wed Sep 17 23:29:41 2008
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 1C1521065674
	for <freebsd-questions@freebsd.org>;
	Wed, 17 Sep 2008 23:29:41 +0000 (UTC)
	(envelope-from glarkin@FreeBSD.org)
Received: from mail1.sourcehosting.net (113901-app1.sourcehosting.net
	[72.32.213.11]) by mx1.freebsd.org (Postfix) with ESMTP id EB24D8FC1B
	for <freebsd-questions@freebsd.org>;
	Wed, 17 Sep 2008 23:29:40 +0000 (UTC)
	(envelope-from glarkin@FreeBSD.org)
Received: from 68-189-244-97.dhcp.oxfr.ma.charter.com ([68.189.244.97]
	helo=Gregory-Larkins-Computer.local)
	by mail1.sourcehosting.net with esmtp (Exim 4.69 (FreeBSD))
	(envelope-from <glarkin@FreeBSD.org>)
	id 1Kg6Sn-000HDt-Vm; Wed, 17 Sep 2008 19:29:39 -0400
Received: from [127.0.0.1] (fireball.entropy.prv [192.168.1.12])
	by Gregory-Larkins-Computer.local (Postfix) with ESMTP
	id 3D62824EADCC; Wed, 17 Sep 2008 19:29:38 -0400 (EDT)
Message-ID: <48D192E7.4060208@FreeBSD.org>
Date: Wed, 17 Sep 2008 19:29:43 -0400
From: Greg Larkin <glarkin@FreeBSD.org>
Organization: The FreeBSD Project
User-Agent: Thunderbird 2.0.0.16 (Windows/20080708)
MIME-Version: 1.0
To: "Marc G. Fournier" <scrappy@hub.org>
References: <14143EECEC1CC52A4BC39AC3@ganymede.hub.org>
In-Reply-To: <14143EECEC1CC52A4BC39AC3@ganymede.hub.org>
X-Enigmail-Version: 0.95.7
OpenPGP: id=1C940290
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Spam-Score: -1.2 (-)
Cc: freebsd-questions@freebsd.org
Subject: Re: Auto blacklist ssh connections ...
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: glarkin@FreeBSD.org
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 17 Sep 2008 23:29:41 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Marc G. Fournier wrote:
> 
> Does anyone know of a utility that I can use with sshd to auto-block by IP if 
> there are more then N failed attempts in a row?
> 
> ie:
> 
> # grep "Invalid user" /var/log/auth.log| awk '{print $10}' | sort | uniq -c | 
> sort -nr
[...]
> 
> 
> This is for one day ... I'd like to be able to throttle so that after X Invalid 
> user attempts, the IP gets blocked ...
> 
> Possible?
> 

Hi Marc,

Coincidentally, I've been replacing sshit with sshguard (both in ports)
on several servers today.  sshguard seems to be more configurable and
supports a number of blocking methods - multiple firewalls as well as
/etc/hosts.deny.  Here's the full documentation:
http://sshguard.sourceforge.net/doc/

Hope that helps,
Greg
- --
Greg Larkin

http://www.FreeBSD.org/       - The Power To Serve
http://www.sourcehosting.net/ - Ready. Set. Code.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFI0ZLn0sRouByUApARAt5XAJ91sn31ryJ4iq+t4OzVoORYK29IVwCglRAG
rE3TmCDo70nzxvUBFWVCUJI=
=fQhA
-----END PGP SIGNATURE-----