On Thursday 22 Jan 2009, Paul Hartman wrote: > On Wed, Jan 21, 2009 at 11:53 AM, Nikos Chantziaras <rea...@arcor.de> wrote:
> Jan 21 14:35:43 [sshd] Invalid user murray from 203.110.208.68 > > > So, 11 attempts in the first minute of activity (and it picked up > pace, later on attempting every 2 seconds). Surely denyhosts should > have blocked it already at that point based on my settings, correct? Your regex's might not be up to snuff. Try adding the one below to denyhosts.conf: USERDEF_FAILED_ENTRY_REGEX=Invalid user (?P<user>.*) .*from (::ffff:)? (?P<host>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) HTH -Robin --