Re: SSH server under attack...

[gmHumfrey () yahoo com]

When a machine I support was getting a significant number of ssh password attempts I went searching and found a utility 
called Daemonshield (http://sourceforge.net/projects/daemonshield/ ) .  You can configure it to block the IP address 
that the attempts are coming from, for a time period that you specify.  In the case of the aforementioned system, I set 
the parameters to 5 attempts locks out for 24 hours. If the system you are supporting as more public requirements you 
may have to set the lockout value a little higher. In this case, your attacker will likely try different IP addresses, 
but at 5 attempts per IP address per 24 hours (or whatever you set) they aren't going to get anywhere fast.  Please be 
aware your attacker can still flood your system with attempts and create a DoS .   

Best Regards

Mike Webb

---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Tailor your education to your own professional goals with degree 
customizations including Emergency Management, Business Continuity Planning, 
Computer Emergency Response Teams, and Digital Investigations. 

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------