Re: SSH scans vs connection ratelimiting

Lyndon Nerenberg wrote:
> Take a look at /usr/ports/security/bruteforceblocker.  It monitors the 
> system log for failed ssh logins, and blocks the sites via pf.  It's 
> reasonably configurable, and works very well.  I've been running it for 
> months without trouble.
I've written a similar script which worked okay for the most part. 
Probably not as fancy, but a la.

Point is, I'd prefer to:
1) Know why the attack still works although I'm ratelimiting to 3 
connections per minute and MaxAuthTries is set to 3 (but if it was still 
the default value 6, it should've triggered, too)
2) Fix it at the root cause, probably OpenSSH?

-- 
Pieter

_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"