I manage several different pf firewalls around the country, and so I
need to have ssh access allowed. Occaisionally, (more and more often
lately), I get script kiddies having a go at brute forcing my root
password (see below) or brute forcing a selection of guessed account
names (like guest, admin, root, ...)
While I have quite secure passwords, the blatting of my console is
something I object to quite highly. Is there a way in PF to detect all
these failed ssh connection attempts from a single address in a small
time period and block them for a given time period?
Is there something else I can use to do this more elegantly?
A more simple solution might be to disable password authentication, and
allow only RSA authentication. That way, without the private key, all
the guessing in the world won't help them.
Cheers,
--Matt
