Re: log monitoring, changing iptables

[Jorge Gajon <jorge.gajon () gmail com>]

Although this isn't what you are asking here, I'll recommend you read
this good article http://www.securityfocus.com/infocus/1810 which show
you how to enable publick key authentication.

After you enable it and it is working correctly, disable Password
authentications, in the /etc/ssh/sshd_config file have these lines
PermitRootLogin no
PasswordAuthentication no

Like you I was having a maraton of guess attempts everyday, which was
making me somewhat nervous. Now the ssh daemon only accepts
connections from my machine at the office and my other machine at
home.

Forgive me if you already knew all this or if somebody has already told it.
Regards

- Jorge Gajon

> On Tue, 22 Nov 2004, Tom Boulay wrote:
>       I'm sorry if this is overly simple, I'm just new to it.  I'm trying to
> figure out a way to monitor my system logs and use that information to
> ignore traffic from an IP address for, say, 15 minutes after three
> failed login attempts.  My machine (2.4.x) only has ssh listening.  My
> logs seem to have some marathon repeated root login attempts on the
> weekends, and I would like to discourage those by including the 15
> minute delay.  How would I monitor the /var/log/messages?  Do I need to
> use something like sec?