Hi there

2006/10/5, Daniel da Veiga <[EMAIL PROTECTED]>:
On 10/5/06, José González Gómez <[EMAIL PROTECTED]> wrote:
> Hi there,
>
> I've got a virtual private server hosted somewhere and they're blocking me
> because their intrusion detection system detects 10 ssh connections in less
> than 2 minutes from my current IP. My question is: is it possible for an
> intrusion detection system to differentiate between successful and
> unsuccessful ssh connections so they don't block me? Of course all my
> connections are successful.
>

As Hans-Werner already told you, there are better ways to detect
intrusion, and of course they could implement it in a way successful
connection would not cause the intrusion detect system to block you,
but its a bit more complicated and would involve the whole system,
wich most providers do not want/care to have and if they have, they
charge over it.

The questions here, if you don't want to argue with your host
provider, would be:
1) Is there another provider that does not have such limitation?

Well, I would really know about this... does anybody know?

2) 10 connection in 2 minutes is a good config, why do you have so
many connections in so little time? Is there another way to do
whatever you're trying to do with less connections?

Unfortunately I'm not "responsible" for making these connections. I'm using Maven (http://maven.apache.org/) to deploy some files to my server. Maven seems to use a different ssh connection for every operation it does (check for current version deployed, read metadata, copy several files to remote server...). I'll write to the Maven list to ask about this, maybe there is some way to slow down or reuse connections.

I've rewrote a complete system just so I would not have to discuss my
ISP security policies. I guess it was faster to change a few hundred
lines of code than to keep calling them on the phone to argue about it
(if I could, I would have changed ISP).


Well, that's another option. After all Maven is open source, so I could take a look at the code making the connections and try to improve it.

Thanks a lot, best regards
Jose

Reply via email to