Re: SSH and telnet Login Attempt Rules

[Frank Knobbe <frank () knobbe us>]

On Tue, 2005-09-27 at 21:53 -0500, Ron Jenkins wrote:
> Does anyone have rules that will detect these two?

I think we got several rules that do something like you desire over at
BleedingSnort.com in the bleeding-scan.rules. May need minor tweaking
(like adjusting/removing thresholds). If you are not familiar with the
project, check it out at http://www.bleedingsnort.com

Cheers,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part