Re: OpenSSH -- a way to block recurrent login failures?

So you want to block an IP address as opposed to locking a particular
account, right?
I don't know of any easy method to accomplish what you are trying to
do other than something similar to what you described...  Automating
stuff like that is playing with fire though, for not a whole lot of
benefit.
Why not monitor the logs and have it page you when a certain number of
login failures occur from a certain IP?  That way you can log in and
verify that the IP should be blocked, then you could do something like
add a null route to the host, which is more effective than adding it
to hosts.deny anyway...


On Tue, 21 Sep 2004 10:02:22 -0400 (EDT), Victor Danilchenko
<danilche@cs.umass.edu> wrote:
>         Hi,
>
>         We are looking for a way to temporarily block hosts from which
> we receive a given number of sequential failed login attempts, not
> necessarily within the same SSH session (so MaxAuthTries is not enough).
> The best solution I could come up with so far would be to run OpenSSH
> through TCPWrappers, and set up a log watcher daemon which would edit
> /etc/hosts.deny on the fly based on the tracked number of failed logins
> for each logged host.
>
>         Is there a better solution known for the sort of problems we
> have been plagued with lately -- repeated brute-force crack attempts
> from remote hosts? I looked on FreshMeat and I searched the mailing
> lists, only to come up empty-handed.
>
>         Thanks in advance,
>
> --
> |  Victor  Danilchenko  +---------------------+
> | danilche@cs.umass.edu | He who laughs last, |
> |   CSCF   |   5-4231   | thinks slowest.     |