Re: [tlug] attack via ssh? (don't panic :-P)

[Stuart Luppescu <s-luppescu@example.com>]

On 金, 2005-05-13 at 23:40 +0900, Michael Reinsch wrote:
> So I've written a small script that keeps an eye on those login
> attempts and blocks the corresponding IP address after some failed
> login attempts for about an hour. The heuristic used by this script to
> detect those attacks was designed to be very simple and not to
> interfere with normal user activity.
> 
> I'm planning to release this script some time soon - well, sooner if
> someone is really interested ;-)

I'm really interested. I get these at least once a day. If I notice it
on root-tail, I add the originating IP address to my set of iptables
rules to block. I have had PasswordAuthentication set to no
in /etc/ssh/sshd_config, but it doesn't seem to have any effect. :-<
-- 
Stuart Luppescu -=-=- s-luppescu <AT> uchicago <DOT> edu
CCSR at U of C   (^_^)/   www.consortium-chicago.org
Where are we going? And what are we doing in this handbasket?

Attachment: signature.asc
Description: This is a digitally signed message part