tefol tefol wrote:
Hi there.
I manage several different pf firewalls around the country, and so I need to have ssh access allowed. Occaisionally, (more and more often lately), I get script kiddies having a go at brute forcing my root password (see below) or brute forcing a selection of guessed account names (like guest, admin, root, ...)
While I have quite secure passwords, the blatting of my console is something I object to quite highly. Is there a way in PF to detect all these failed ssh connection attempts from a single address in a small time period and block them for a given time period?
Is there something else I can use to do this more elegantly?
Ok, firstly I probably woulnt be granting root access without having to SU to it. The way I make sure no-one can get in is to set a AllowUsers in my sshd_config, you dont need to have root in here as you elevate priveledges by su'ing rather than logging in as root. On my server I have:-
AllowUsers paul david simon (example only)
I know its not a pf solutions but it should help you harden things up a little.
Matt.
