Re: OpenSSH -- a way to block recurrent login failures?

Instead of running ssh from xinetd and modify the hosts.deny file using
a script, why not let the script watch excessive failures in auth.log
and pushing and iptables rule ?? I think that this is an easiest way to
solve the issue.

You can use cron to remove entries with had been inserted more than 1
hour ago for ex, or let the rule come part of the standar ruleset in
case you are allready filtering with iptables on this host ..


Best regards




El mar, 21-09-2004 a las 16:02, Victor Danilchenko escribió:
>       Hi,
>
>       We are looking for a way to temporarily block hosts from which
> we receive a given number of sequential failed login attempts, not
> necessarily within the same SSH session (so MaxAuthTries is not enough).
> The best solution I could come up with so far would be to run OpenSSH
> through TCPWrappers, and set up a log watcher daemon which would edit
> /etc/hosts.deny on the fly based on the tracked number of failed logins
> for each logged host.
>
>       Is there a better solution known for the sort of problems we
> have been plagued with lately -- repeated brute-force crack attempts
> from remote hosts? I looked on FreshMeat and I searched the mailing
> lists, only to come up empty-handed.
>
>       Thanks in advance,