On Monday 13 August 2007 12:21:34 Simon Hobson wrote: > Configure sshd to only allow selected users (and specifically NOT > root !), make sure all allowed users have good passwords. Then > install something like fail2ban. > > fail2ban simply watches your logs, and if you have a number > (configurable) of failed login attempts it adds an iptables rule to > block connections from that IP for a (configurable) time. Apart from > limiting to specific fixed IPs, it's probably about as secure as > you'll get it. I used to regularly get hundred of connection attempts > every day, obvious brute force attacks - now they simply get blocked > by fail2ban and the attacker simply goes somewhere else. > > > If you still want to filter by IP address, how about filtering by the > IP block that home and work are allocated from ? It won't stop > someone on the same ISP from attacking you (in which case you could > complain and get them kicked out), but it will stop the rest of the > world.
Hi Simon, Yeah this sounds like some very good ideas. I should find out what the IP block is at my ISP and will look into using fail2ban or similar and lastly will put to practice using IPs and not DNS names in the rules file etc. :) Thanks for the tipps! :) -- Divan Santana Skype: DivanSantana Gtalk/MSN: [EMAIL PROTECTED] Love God, Love People, Love Life! ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
