The ones I see in my logs tend to be pretty lame attempts (not sure what the tool is). Are you seeing more than a few in a minute? I just never see this as very sophisticated, and kind of live with it, although I would like to block it too; I don't have the option of going all key with my users.
| Stef - http://caunter.ca/contact.html This email is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. On Fri, 6 May 2005, Mark Leisher wrote: > We suffer from a lot of brute force password attacks against ssh. Is there any > way to get the netfilter "recent" module behavior out of IPF (see related link > below)? > > http://blog.andrew.net.au/2005/02/17#ipt_recent_and_ssh_attacks > -- > --------------------------------------------------------------------------- > Mark Leisher > Computing Research Lab Frantic orthodoxy is never rooted in > New Mexico State University faith but in doubt. It is when we are > Box 30001, MSC 3CRL unsure that we are doubly sure. > Las Cruces, NM 88003 -- Reinhold Niebuhr (1892-1971) >
