From owner-freebsd-questions@FreeBSD.ORG Thu Sep 18 03:14:44 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 7D077106566C for ; Thu, 18 Sep 2008 03:14:44 +0000 (UTC) (envelope-from nslay@comcast.net) Received: from QMTA06.emeryville.ca.mail.comcast.net (qmta06.emeryville.ca.mail.comcast.net [76.96.30.56]) by mx1.freebsd.org (Postfix) with ESMTP id 5CB5D8FC16 for ; Thu, 18 Sep 2008 03:14:44 +0000 (UTC) (envelope-from nslay@comcast.net) Received: from OMTA05.emeryville.ca.mail.comcast.net ([76.96.30.43]) by QMTA06.emeryville.ca.mail.comcast.net with comcast id G1lZ1a0060vp7WLA62yi2Z; Thu, 18 Sep 2008 02:58:42 +0000 Received: from LIGHTBULB.LOCAL ([68.35.224.189]) by OMTA05.emeryville.ca.mail.comcast.net with comcast id G2yf1a00G45o48c8R2yhy9; Thu, 18 Sep 2008 02:58:42 +0000 X-Authority-Analysis: v=1.0 c=1 a=cq7dR5dDzvAA:10 a=BOuI2C-NPVsA:10 a=QWeeBq_sAAAA:8 a=LYcaMSdMAAAA:8 a=6I5d2MoRAAAA:8 a=_39AlOq0XQL7o3_cylgA:9 a=0qvkJJCeAojtL0K0nyUA:7 a=CxoGm4K7YrPB9HW8DVfHGgqNf08A:4 a=3S9CAzLaMNUA:10 a=mlQ6C7Yp8iEA:10 a=SV7veod9ZcQA:10 a=gi0PWCVxevcA:10 Message-ID: <48D1C3CA.30309@comcast.net> Date: Wed, 17 Sep 2008 22:58:18 -0400 From: Nathan Lay User-Agent: Thunderbird 2.0.0.16 (X11/20080821) MIME-Version: 1.0 To: "Marc G. Fournier" References: <14143EECEC1CC52A4BC39AC3@ganymede.hub.org> In-Reply-To: <14143EECEC1CC52A4BC39AC3@ganymede.hub.org> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-questions@freebsd.org Subject: Re: Auto blacklist ssh connections ... X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Sep 2008 03:14:44 -0000 I employed this solution: http://johan.fredin.info/openbsd/block_ssh_bruteforce.html You have to enable pf, but man it works and it works well! Best Regards, Nathan Lay Marc G. Fournier wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > Does anyone know of a utility that I can use with sshd to auto-block by IP if > there are more then N failed attempts in a row? > > ie: > > # grep "Invalid user" /var/log/auth.log| awk '{print $10}' | sort | uniq -c | > sort -nr > 5268 140.113.210.174 > > 4863 72.52.225.116 > > 3586 116.14.255.141 > > 2918 193.205.186.67 > > 2033 219.76.75.6 > > 1308 216.14.127.67 > > 1059 61.72.106.71 > > 983 93.123.14.9 > > 691 202.75.221.197 > > 649 59.77.33.139 > > 381 201.80.15.207 > > 269 190.10.255.73 > > 212 81.252.254.189 > > 181 123.151.32.12 > > 150 211.21.47.50 > > 139 196.219.63.3 > > 128 200.111.64.171 > > > > This is for one day ... I'd like to be able to throttle so that after X Invalid > user attempts, the IP gets blocked ... > > Possible? > > - -- > Marc G. Fournier Hub.Org Hosting Solutions S.A. (http://www.hub.org) > Email . scrappy@hub.org MSN . scrappy@hub.org > Yahoo . yscrappy Skype: hub.org ICQ . 7615664 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v2.0.9 (FreeBSD) > > iEYEARECAAYFAkjRj6EACgkQ4QvfyHIvDvOsYQCgyaB3MhvHJk9qShRlovwSAXxx > 3oQAn2NQ8zLFVO82Udp+mZaojwbfoKmw > =SuAI > -----END PGP SIGNATURE----- > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org" > >