Re: log monitoring, changing iptables

[Alexander Klimov <alserkli () inbox ru>]

Hi.

On Tue, 22 Nov 2004, Tom Boulay wrote:
>       I'm sorry if this is overly simple, I'm just new to it.  I'm trying to
> figure out a way to monitor my system logs and use that information to
> ignore traffic from an IP address for, say, 15 minutes after three
> failed login attempts.  My machine (2.4.x) only has ssh listening.  My
> logs seem to have some marathon repeated root login attempts on the
> weekends, and I would like to discourage those by including the 15
> minute delay.  How would I monitor the /var/log/messages?  Do I need to
> use something like sec?

The topic of these login attempts was discussed here some time ago. Don't
sure what was the conclusion, I guess there are simpler reactions:
 -- make sure that your passwords can't be broken (e.g., use private/public
    key pair for authentication)
 -- move ssh to a non-standard port

Regards,
ASK