Security Incidents mailing list archives
re: SSH scans...
From: "brian () ethernet org" <brian () ethernet org>
Date: Tue, 21 Dec 2004 14:14:48 -0500 (EST)
i dont know how relevant this is, but-- i've been getting a lot of these too, but what's been annoying me is that they took bandwidth and space in my logs which i both need as the brute force attempts were mainly to my development machines. so i wrote this little piece of code called 'timelox' that allowed me to specify how many failed logins i want to allow from a single host in a time-frame of N seconds before i firewall it. http://ethernet.org/~brian/src/timelox/ this was written basically for private use so dont expect too much fancy stuff. look at the code, read the README, and if you like the idea you can even use it. ;) if you need help adding it to the daemon of your choice or help understanding how to implement it yourself you can contact me - but note you need some basic programming background... this was tested only on openbsd (as this is what i run) but you could easily port it. the most important thing to note is that the code does *not* contain anything to actually firewall the offending host. you can snprintf() it and execute or write ioctl()'s to do it, whatever you like. just read the comments if you decide to use it. sorry if this is irrelevant.. -b.
Current thread:
- Re: SSH scans..., (continued)
- Re: SSH scans... Gerry Dalton (Dec 20)
- Re: SSH scans... Peter Willis (Dec 20)
- Re: SSH scans... skippy1 (Dec 21)
- Re: SSH scans... Peter Willis (Dec 20)
- Re: SSH scans... Raymond Lillard (Dec 20)
- Re: SSH scans... Ben Nelson (Dec 20)
- Re: SSH scans... Steve Kemp (Dec 20)
- RE: SSH scans... KEM Hosting (Dec 21)
- Re: SSH scans... Michael H. Warfield (Dec 21)
- Re: SSH scans... nixsec (Dec 22)
- Re: SSH scans... Dejan Markovic (Dec 22)
- re: SSH scans... brian () ethernet org (Dec 21)
- re: SSH scans... Kerry Thompson (Dec 22)
- Re: SSH scans... Gerry Dalton (Dec 20)