Forgive the top posting (long message) ;) A quick way to make that crap go away is to run your ssh on a different port. quick, simple, effective. I used to have those "brute force" attacks every day and fill my logs and I would go in and create and entry that that entire Netmask in the ipfw and hosts.allow files but that got tedious real quick. Changing the port made my life easier. ssh -p 99 -l yournamehere 192.168.1.10
On Wed, 2005-04-06 at 07:15 +0000, Edwin D. Vinas wrote: > hello, > > shown below is snapshot of too many illegal attempts to login to my > server from a suspicious hacker. this is taken from the > "/var/log/auth.log". my question is, how do i automatically block an > IP address if it is attempting to guess my login usernames? can i > configure the firewall to check the instances a certain IP has > attempted to access/ssh the sevrer, and if it has failed to login for > about "x" number of attempts, it will be blocked automatically? > > thank you in advance! > > -edwin > > ---------------- > Mar 26 05:00:00 pawikan newsyslog[11879]: logfile turned over due to size>100K > Mar 26 22:49:29 pawikan sshd[66637]: Illegal user test from 211.176.33.46 > Mar 26 22:49:32 pawikan sshd[66639]: Illegal user guest from 211.176.33.46 > Mar 26 22:49:35 pawikan sshd[66641]: Illegal user admin from 211.176.33.46 > Mar 26 22:49:37 pawikan sshd[66643]: Illegal user admin from 211.176.33.46 > Mar 26 22:49:40 pawikan sshd[66645]: Illegal user user from 211.176.33.46 > Mar 26 22:49:50 pawikan sshd[66654]: Illegal user test from 211.176.33.46 > Mar 27 02:50:12 pawikan sshd[69369]: Illegal user test from 210.0.141.89 > Mar 27 02:50:14 pawikan sshd[69463]: Illegal user guest from 210.0.141.89 > Mar 27 02:50:15 pawikan sshd[69650]: Illegal user admin from 210.0.141.89 > Mar 27 02:50:17 pawikan sshd[69745]: Illegal user admin from 210.0.141.89 > Mar 27 02:50:18 pawikan sshd[69858]: Illegal user user from 210.0.141.89 > Mar 27 02:50:24 pawikan sshd[70319]: Illegal user test from 210.0.141.89 > Mar 27 04:10:58 pawikan sshd[5171]: Illegal user test from 218.188.9.202 > Mar 27 04:10:59 pawikan sshd[5173]: Illegal user guest from 218.188.9.202 > Mar 27 04:11:00 pawikan sshd[5175]: Illegal user admin from 218.188.9.202 > Mar 27 04:11:01 pawikan sshd[5190]: Illegal user admin from 218.188.9.202 > Mar 27 04:11:02 pawikan sshd[5192]: Illegal user user from 218.188.9.202 > Mar 27 04:11:07 pawikan sshd[5200]: Illegal user test from 218.188.9.202 > Mar 27 12:13:21 pawikan sshd[9236]: Did not receive identification > string from 61.59.143.27 > Mar 27 12:23:03 pawikan sshd[13482]: Illegal user jordan from 61.59.143.27 > Mar 27 12:23:07 pawikan sshd[13484]: Illegal user michael from 61.59.143.27 > Mar 27 12:23:11 pawikan sshd[13486]: Illegal user nicole from 61.59.143.27 > Mar 27 12:23:14 pawikan sshd[13488]: Illegal user daniel from 61.59.143.27 > Mar 27 12:23:18 pawikan sshd[13490]: Illegal user andrew from 61.59.143.27 > Mar 27 12:23:21 pawikan sshd[13492]: Illegal user nathan from 61.59.143.27 > Mar 27 12:23:25 pawikan sshd[13494]: Illegal user matthew from 61.59.143.27 > Mar 27 12:23:29 pawikan sshd[13496]: Illegal user magic from 61.59.143.27 > Mar 27 12:23:33 pawikan sshd[13498]: Illegal user lion from 61.59.143.27 > Mar 27 12:23:37 pawikan sshd[13500]: Illegal user david from 61.59.143.27 > Mar 27 12:23:41 pawikan sshd[13502]: Illegal user jason from 61.59.143.27 > Mar 27 12:23:45 pawikan sshd[13504]: Illegal user ben from 61.59.143.27 > Mar 27 12:23:49 pawikan sshd[13506]: Illegal user carmen from 61.59.143.27 > Mar 27 12:23:53 pawikan sshd[13510]: Illegal user justin from 61.59.143.27 > Mar 27 12:23:57 pawikan sshd[13512]: Illegal user charlie from 61.59.143.27 > Mar 27 12:24:02 pawikan sshd[13514]: Illegal user steven from 61.59.143.27 > Mar 27 12:24:06 pawikan sshd[13517]: Illegal user brandon from 61.59.143.27 > Mar 27 12:24:09 pawikan sshd[13519]: Illegal user brian from 61.59.143.27 > Mar 27 12:24:13 pawikan sshd[13521]: Illegal user stephen from 61.59.143.27 > Mar 27 12:24:17 pawikan sshd[13523]: Illegal user william from 61.59.143.27 > Mar 27 12:24:21 pawikan sshd[13525]: Illegal user angel from 61.59.143.27 > Mar 27 12:24:27 pawikan sshd[13527]: Illegal user emily from 61.59.143.27 > Mar 27 12:24:31 pawikan sshd[13529]: Illegal user eric from 61.59.143.27 > Mar 27 12:24:36 pawikan sshd[13531]: Illegal user joe from 61.59.143.27 > Mar 27 12:24:39 pawikan sshd[13533]: Illegal user tom from 61.59.143.27 > Mar 27 12:24:43 pawikan sshd[13535]: Illegal user billy from 61.59.143.27 > Mar 27 12:24:47 pawikan sshd[13537]: Illegal user buddy from 61.59.143.27 > Mar 27 12:24:50 pawikan sshd[13540]: Illegal user jeremy from 61.59.143.27 > Mar 27 12:24:54 pawikan sshd[13542]: Illegal user vampire from 61.59.143.27 > Mar 27 12:24:57 pawikan sshd[13544]: Illegal user betty from 61.59.143.27 > Mar 27 12:25:00 pawikan sshd[13546]: Illegal user henry from 61.59.143.27 > Mar 27 12:25:04 pawikan sshd[13749]: Illegal user max from 61.59.143.27 > Mar 27 12:25:07 pawikan sshd[14024]: Illegal user nicholas from 61.59.143.27 > Mar 27 12:25:11 pawikan sshd[14336]: Illegal user robin from 61.59.143.27 > Mar 27 12:25:15 pawikan sshd[14644]: Illegal user system from 61.59.143.27 > Mar 27 12:25:18 pawikan sshd[14904]: Illegal user johnny from 61.59.143.27 > Mar 27 12:25:22 pawikan sshd[15221]: Illegal user lucy from 61.59.143.27 > Mar 27 12:25:26 pawikan sshd[15521]: Illegal user market from 61.59.143.27 > Mar 27 12:25:32 pawikan sshd[15673]: Illegal user lp from 61.59.143.27 > Mar 27 12:25:37 pawikan sshd[15675]: Illegal user maria from 61.59.143.27 > Mar 27 12:25:42 pawikan sshd[15677]: Illegal user rose from 61.59.143.27 > Mar 27 12:25:47 pawikan sshd[15679]: Illegal user mail from 61.59.143.27 > Mar 27 12:25:52 pawikan sshd[15681]: Illegal user god from 61.59.143.27 > Mar 27 12:25:56 pawikan sshd[15683]: Illegal user barbara from 61.59.143.27 > Mar 27 12:26:05 pawikan sshd[15688]: Illegal user larisa from 61.59.143.27 > Mar 27 12:26:10 pawikan sshd[15690]: Illegal user shell from 61.59.143.27 > Mar 27 12:26:15 pawikan sshd[15692]: Illegal user jane from 61.59.143.27 > Mar 27 12:26:19 pawikan sshd[15694]: Illegal user dog from 61.59.143.27 > Mar 27 12:26:23 pawikan sshd[15696]: Illegal user blue from 61.59.143.27 > _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
