If you're running iptables why not make use of hashlimit? Once a limit is reached all connection attempts from that IP would be blocked until the hash entry expires.
An example pulled from the web: iptables -A INPUT -m hashlimit -m tcp -p tcp --dport 22 --hashlimit \ 1/min --hashlimit-mode srcip --hashlimit-name ssh -m state \ --state NEW -j ACCEPT https://www.redhat.com/archives/fedora-test-list/2005-August/msg00061.html http://tinyurl.com/94fak Also, don't forget to man iptables or iptables -m hashlimit -h -miah On Fri, Sep 02, 2005 at 07:33:02PM +0800, Michael L Benjamin wrote: > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Pedro > Hugo > Sent: Friday, 2 September 2005 05:53 PM > To: [email protected] > Subject: Re: [Full-disclosure] SSH Bruteforce blocking script > > Hi, > > >I don't want to debate the goodness or badness of the strategy of > >blocking hosts like this in /etc/hosts.deny. It works perfectly for me, > >and most > >likely would for you, so no religious debates thanks. It's effective at > >blocking bruteforce attacks. If a host EXCEEDS a specified number of > >guesses > >during the (configurable) 30 seconds it takes the script to cycle, the > >host is blacklisted. > > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
