Re: Constant low-level attack

2012-06-29 Thread Rich Kulawiec
On Thu, Jun 28, 2012 at 01:31:56PM -0700, Lou Katz wrote: > 2. Is there anything useful to do with this info other than put the IP > addresses into a firewall reject table? Do you need to allow inbound ssh connections from the entire planet? If not, then head over to ipdeny.com and grab the rel

Re: Constant low-level attack

2012-06-29 Thread Alain Hebert
Hi, We implemented fail2ban about a year ago to cut down on incoming spamming (down from 500k+ emails a day to 20k) Now what can I do with the ~11,000 IP's I identify as spammer every week :( Reporting them to their Telco is pretty much a waste of time... they are not about

Re: Constant low-level attack

2012-06-28 Thread Denys Fedoryshchenko
On 2012-06-28 23:31, Lou Katz wrote: The other day, I looked carefully at my auth.log (Xubuntu 11.04) and discovered many lines of the form: Jun 28 13:13:54 localhost sshd[12654]: Bad protocol version identification '\200F\001\003\001' from 94.252.177.159 In the past day, I have recorded

Re: Constant low-level attack

2012-06-28 Thread TR Shaw
On Jun 28, 2012, at 4:31 PM, Lou Katz wrote: > The other day, I looked carefully at my auth.log (Xubuntu 11.04) and > discovered many lines > of the form: > > Jun 28 13:13:54 localhost sshd[12654]: Bad protocol version > identification '\200F\001\003\001' from 94.252.177.159 > > In the p

Constant low-level attack

2012-06-28 Thread Lou Katz
The other day, I looked carefully at my auth.log (Xubuntu 11.04) and discovered many lines of the form: Jun 28 13:13:54 localhost sshd[12654]: Bad protocol version identification '\200F\001\003\001' from 94.252.177.159 In the past day, I have recorded about 20,000 unique IP addresses used