On Thursday 22 Jan 2009, Paul Hartman wrote:
> On Wed, Jan 21, 2009 at 11:53 AM, Nikos Chantziaras <[email protected]> wrote:
> Jan 21 14:35:43 [sshd] Invalid user murray from 203.110.208.68
>
>
> So, 11 attempts in the first minute of activity (and it picked up
> pace, later on attempting every 2 seconds). Surely denyhosts should
> have blocked it already at that point based on my settings, correct?
Your regex's might not be up to snuff. Try adding the one below to
denyhosts.conf:
USERDEF_FAILED_ENTRY_REGEX=Invalid user (?P<user>.*) .*from (::ffff:)?
(?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
HTH
-Robin
--
