Re: OpenSSH -- a way to block recurrent login failures?

On 21-09-2004 at 10:02:22AM -0400, Victor Danilchenko wrote:
VD>     Hi,
VD> 
VD>     We are looking for a way to temporarily block hosts from which
VD> we receive a given number of sequential failed login attempts, not
VD> necessarily within the same SSH session (so MaxAuthTries is not enough).
VD> The best solution I could come up with so far would be to run OpenSSH
VD> through TCPWrappers, and set up a log watcher daemon which would edit
VD> /etc/hosts.deny on the fly based on the tracked number of failed logins
VD> for each logged host.
VD> 
VD>     Is there a better solution known for the sort of problems we
VD> have been plagued with lately -- repeated brute-force crack attempts
VD> from remote hosts? I looked on FreshMeat and I searched the mailing
VD> lists, only to come up empty-handed.
VD> 

mkfifo /dev/auth

Add to syslog.conf:
auth,authpriv.*                 |/dev/auth

reload syslog

Now write simple program which reads data from fifo (/dev/auth) and inserts 
iptables (ipf)
rules (perl will be the best).

Your tool blocks IP's in real time.

I wrote something similar for POP-before-SMTP:
http://www.bmk.bz/logrelay-pop3/

If You have no time try portsentry.

Best regards,
   Bartek.
--
If You want to verify authentication of my e-mail visit: www.bmk.bicom.pl
   to get from there my public key.