<HTML>
<HEAD>
<META content="text/html; charset=iso-8859-1" http-equiv=Content-Type>
<META content="OPENWEBMAIL" name=GENERATOR>
</HEAD>
<BODY bgColor=#ffffff>
Sounds like a very handy tool.
<br />
<br />I'm safe as far as SSH is concerned, I've got that port and Telnet blocked at my front-door router. But I'm sick of hacking attempts via FTP, POP3, and SMTP auth. And just as our earlier friend - I've had many instances of someone guessing passwords (usually stupid stuff like username "info" and password "info").
<br />
<br />Besides parsing the /var/log/secure file - can you configure DenyHosts to parse /var/log/maillog and lock out those IPs guessing POP3 passwords??
<br />
<br />
<br />Chuck
<br />
<br />
<br />
<br /><font size="2"><b>---------- Original Message
-----------</b>
<br />
From: Alan Kline <alan@snugglebunny.us>
<br />
To: BlueOnyx General Mailing List <blueonyx@blueonyx.it>
<br />
Sent: Sat, 11 Jul 2009 19:36:31 -0500
<br />
Subject: [BlueOnyx:01650] Re: Slammed with Spammer
<br />
<br />> Paul--
<br />>
<br />>
I've been very pleased with DenyHosts since Chris Gebhardt turned me on to it.
<br />>
It's a nice Python script. Essentially, I run it as a cron job every 10
<br />>
minutes. It scans the secure log file. When it detects a certain number of
attempts to
<br />>
login through ssh by invalid users, bad passwords, or whatever, it'll
automatically
<br />>
add that IP to your hosts.deny file. It also can be set to exchange info
<br />>
with other machines running DenyHosts. You can configure the number of
<br />>
failed attempts before it acts, and set it to block ssh or all services.
<br />>
<br />>
It doesn't catch everything--I still have to manually add the vermin who try to
<br />>
hack my website and databases--but it helps a lot.
<br />>
<br />>
The URL is <a target="_blank" href="http://www.denyhosts.net/">www.denyhosts.net</a>
<br />>
<br />>
Alan
<br />>
<br />>
Paul wrote:
<br />>
<br />>
> Michael/Jeff/Jim/Larry,
<br />>
>
<br />>
> Many thanks to you all - Applied the iptables and /etc/hosts.deny and
<br />>
> all has now stopped from that particular source.
<br />>
> Have also removed the "user" in question... Interestingly enough,
on an
<br />>
> unused site....
<br />>
<br />>
_______________________________________________
<br />>
Blueonyx mailing list
<br />>
Blueonyx@blueonyx.it
<br />>
<a target="_blank" href="http://www.blueonyx.it/mailman/listinfo/blueonyx">http://www.blueonyx.it/mailman/listinfo/blueonyx</a>
<br /><b>------- End of Original Message
-------</b>
<br />
</font>
</BODY>
</HTML>