Over the last few days, I have noticed two events on my servers. The first one relates to SMTP auth failures. For some reason, I was getting absolutely hammered with SMTP auth failures. I dont know why, but PAM_ABL was not kicking in on the failures. DFIX now picks up these, and blocks someone trying to attack via SMTP auth.
The next was ssh attacks. We've all seen "Did not receive identification string from" messages... Denyhosts picks these up, and successfully blocks further attack. However, I've noticed that a lot of the miscreants out there keep trying to connect resulting in a truckload of "refused connect from" ssh log messages. DFIX now picks up the "refused connect from" messages, and blocks the attacker. If someone is determined, this will at least block them from getting in on another port. I've done one other minor change. There is a new log level available, and I have moved the famous non-ip target error message to this new log level. Regards, Greg. -- +---------------------------------------------------------------------+ | / \ Greg Kuhnert, [email protected] | |< o> Compass Networks - Pointing you in the right direction | | \ / Come see us for BlueQuartz / BlueOnyx modules& Support. | +---------------------------------------------------------------------+ _______________________________________________ Blueonyx mailing list [email protected] http://www.blueonyx.it/mailman/listinfo/blueonyx
