full-disclosure - SSH Bruteforce blocking script

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <431A00CC.4030706@holl.co.at>
Date: Sat Sep  3 21:00:52 2005
From: gerald at holl.co.at (Gerald Holl)
Subject: SSH Bruteforce blocking script

On 2005-09-02 09:37, Michael L Benjamin wrote:
> Here is a simple script I've coded up that I use on 3 of my RedHat
> Enterprise Linux 3 (RHEL3) servers. I decided to do this after seeing the
> amount of activity from places like China/Korea/Taiwan in relation to
> SSH brute force probes. I'll throw it open here for
> analysis/suggestions. It
> leverages off the TCPWrappers /etc/hosts.deny /etc/hosts.allow
> functionality.

Hello,

Nice script!
Although I think it's a good way to list that brute force IPs in
/etc/hosts.deny there is another good script that uses iptables to block
the IPs:
http://fail2ban.sourceforge.net/

It works with apache logfiles too.

cheers,
-- 
Gerald Holl
http://holl.co.at