Ciao, io credo che esistanto script che, a partire da questi file di log, bloccano l'indirizzo IP rilevato inserendo altre regole nelle iptables. Tanto.. prima di arrivare alla password tentando un brute-force ci vogliono (a seconda della password che usi) milioni di combinazioni, percui un demone รจ una soluzione assai tempestiva per queste cose. Ce ne sono diversi, fail2ban, sshdfilter. Io personalmente me ne sono scritto uno per me. Ciao, Tommy
> Oct 1 01:51:45 coplast sshd[13855]: Illegal user a from 82.89.167.208 > Oct 1 01:51:49 coplast sshd[13857]: Illegal user b from 82.89.167.208 > Oct 1 01:51:53 coplast sshd[13859]: Illegal user c from 82.89.167.208 > Oct 1 01:51:57 coplast sshd[13861]: Illegal user d from 82.89.167.208 > Oct 1 01:52:01 coplast sshd[13863]: Illegal user e from 82.89.167.208 > Oct 1 01:52:06 coplast sshd[13865]: Illegal user f from 82.89.167.208 > Oct 1 01:52:10 coplast sshd[13867]: Illegal user g from 82.89.167.208 > Oct 1 01:52:14 coplast sshd[13869]: Illegal user h from 82.89.167.208 > Oct 1 01:52:18 coplast sshd[13871]: Illegal user i from 82.89.167.208 > Oct 1 01:52:22 coplast sshd[13873]: Illegal user j from 82.89.167.208 > Oct 1 01:52:27 coplast sshd[13875]: Illegal user k from 82.89.167.208 > Oct 1 01:52:31 coplast sshd[13877]: Illegal user l from 82.89.167.208 > Oct 1 01:52:35 coplast sshd[13879]: Illegal user m from 82.89.167.208 > Oct 1 01:52:39 coplast sshd[13881]: Illegal user n from 82.89.167.208 > Oct 1 01:52:44 coplast sshd[13883]: Illegal user o from 82.89.167.208 > Oct 1 01:52:48 coplast sshd[13885]: Illegal user p from 82.89.167.208 -- Tommaso
pgprw3Q1fAIiB.pgp
Description: PGP signature
