From owner-freebsd-questions@FreeBSD.ORG  Sun Feb 12 09:26:23 2006
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 6BBBE16A420
	for <freebsd-questions@freebsd.org>;
	Sun, 12 Feb 2006 09:26:23 +0000 (GMT)
	(envelope-from bsd@bathnetworks.com)
Received: from lmail.bathnetworks.co.uk (mail.bathnetworks.com [84.92.24.252])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 6DFE943D46
	for <freebsd-questions@freebsd.org>;
	Sun, 12 Feb 2006 09:26:22 +0000 (GMT)
	(envelope-from bsd@bathnetworks.com)
Received: (qmail 18181 invoked by uid 510); 12 Feb 2006 09:28:18 +0000
Received: from 84.92.24.252 by lmail.bathnetworks.co.uk (envelope-from
	<bsd@bathnetworks.com>, uid 508) with qmail-scanner-1.24-st-qms 
	(clamdscan: 0.88/1261. spamassassin: 3.0.2. perlscan: 1.24-st-qms.  
	Clear:RC:0(84.92.24.252):SA:0(-3.6/5.0):. 
	Processed in 0.973175 secs); 12 Feb 2006 09:28:18 -0000
X-Spam-Status: No, hits=-3.6 required=5.0
X-Antivirus-MYDOMAIN-Mail-From: bsd@bathnetworks.com via
	lmail.bathnetworks.co.uk
X-Antivirus-MYDOMAIN: 1.24-st-qms (Clear:RC:0(84.92.24.252):SA:0(-3.6/5.0):.
	Processed in 0.973175 secs Process 18174)
Received: from mail.bathnetworks.com (HELO ?84.92.24.252?)
	(bsd@bathnetworks.com@84.92.24.252)
	by lmail.bathnetworks.co.uk with SMTP; 12 Feb 2006 09:28:17 +0000
From: Robert Slade <bsd@bathnetworks.com>
To: playnet <playnet@mail333.com>
In-Reply-To: <1059667590.20060212073915@mail333.com>
References: <1059667590.20060212073915@mail333.com>
Content-Type: text/plain
Message-Id: <1139736497.17153.14.camel@lmail.bathnetworks.co.uk>
Mime-Version: 1.0
X-Mailer: Ximian Evolution 1.4.6 (1.4.6-2) 
Date: Sun, 12 Feb 2006 09:28:17 +0000
Content-Transfer-Encoding: 7bit
Cc: "freebsd-questions@freebsd.org" <freebsd-questions@freebsd.org>
Subject: Re: incorrect logins
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 12 Feb 2006 09:26:23 -0000

On Sun, 2006-02-12 at 04:39, Playnet wrote:
> Hello FreeBSD,
> 
>   I see many records as
> Feb 10 21:08:55 sstand sshd[84600]: Failed password for root from 61.218.130.20 port 46356 ssh2
> 
> How can i block these IP, who try "root" as login?
> Have any soft in ports?

In the default setup of SSH, root login is disabled. Check the manual
for ssh.

As for blocking Ips check hosts_deny and hosts_allow.

I would recommend that you block the ssh port at you firewall for stop
remote logons via ssh etc.

Rob