On 20Mar2010 17:25, Craig White <craigwhite@xxxxxxxxxxx> wrote: | On Sat, 2010-03-20 at 23:17 +0100, Vadkan Jozsef wrote: | > Two pc's: | > | > 1 - router | > 2 - logger | > | > Situation: someone tries to bruteforce into a server, and the logger | > get's a log about it [e.g.: ssh login failed]. | > | > What's the best method to ban that ip [what is bruteforcig a server] | > what was logged on the logger? | > I need to ban the ip on the router pc. | > | > How can i send the bad ip to the router, to ban it? | > | > Just run a cronjob, and e.g.: scp the list of ip's from the logger to | > the router, then ban the ip from the list on the router pc? | > | > Or is there any "offical" method for this? | > | > I'm just asking for docs/howtos.. :\ to get started.. | ---- | personally, I always use 'denyhosts' package which can be either single | system or can share data with other systems. | | yum search denyhosts I block this stuff with a firewall rule limiting the number of inbound ssh connections in a period of time. It usually cuts this kind of thing off fairly promptly. I'm using pf on an openbsd firewall: # let admin sites in anyway pass log quick proto tcp from <admins> to any port 22 flags S/SA keep state # discard already blocked IPs block drop quick proto tcp from <evil> to any port 22 # allow ssh in unless an IP connects too often, adding it to the # <evil> table used above pass log quick proto tcp from any to any port 22 flags S/SA keep state (max-src-conn-rate 20/60, overload <evil> flush) I believe you can do the same kind of thing in iptables these days if that's what you've got. Cheers, -- Cameron Simpson <cs@xxxxxxxxxx> DoD#743 http://www.cskk.ezoshosting.com/cs/ -- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
