[BlueOnyx:04419] Re: can't stop this attack

[Dudi Goldenberg]

Hi,

>I don't think that will work
>the server has about 250 IP address and probably 750 users.
>The attack uses a different user name and a different IP
>
>possibly hit the 2nd user in a couple of days

fail2ban should still work.

It count authentication failures per given time periods.

Your log snip shows several attempts from the same IP, it would
definitely be caught.

One of my servers (a BQ) has half the IPs but double the users and
fail2ban works wonders there.

Regards,

D.