re: SSH scans...

["brian () ethernet org" <brian () ethernet org>]

i dont know how relevant this is, but--

i've been getting a lot of these too, but what's been annoying me is
that they took bandwidth and space in my logs which i both need as the
brute force attempts were mainly to my development machines.

so i wrote this little piece of code called 'timelox' that allowed me
to specify how many failed logins i want to allow from a single host in
a time-frame of N seconds before i firewall it.

http://ethernet.org/~brian/src/timelox/

this was written basically for private use so dont expect too much
fancy stuff. look at the code, read the README, and if you like the idea
you can even use it. ;) if you need help adding it to the daemon of your
choice or help understanding how to implement it yourself you can
contact me - but note you need some basic programming background...

this was tested only on openbsd (as this is what i run) but you could
easily port it.

the most important thing to note is that the code does *not* contain
anything to actually firewall the offending host. you can snprintf() it
and execute or write ioctl()'s to do it, whatever you like. just read
the comments if you decide to use it.

sorry if this is irrelevant..

-b.