<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>
As far as I know... yes and no....<BR>
<BR>
BO will block accounts and IPs that are attempted to be brute forced, but the account needs to exist, well that has been my experience....<BR>
<BR>
I tend to use the iptables and block /32 or if it is from China or other known hacking countries then a /24 is a minimum... <BR>
<BR>
I have been thinking of routing everything through a firewall or sorts so that the hackers will usually hit it first then get the IP blocked (as all other servers would be on a virtual LAN)... or something like that.... but it needs more thought at this stage and I just dont have the time to look too far into it.<BR>
<BR>
If anyone has a good solution (preferrably free) then I am open to suggestions too (much like most on this list I would assume).<BR>
<BR>
HTH<BR>
<BR>
Brian<BR> <BR>
<DIV>
<DIV id=SkyDrivePlaceholder></DIV>
<HR id=stopSpelling>
From: james@slor.net<BR>To: blueonyx@blueonyx.it<BR>Date: Wed, 9 Jan 2013 09:07:31 -0500<BR>Subject: [BlueOnyx:11940] Blocking brute force SSH login attempts<BR><BR>
<STYLE><!--
.ExternalClass p.ecxMsoNormal, .ExternalClass li.ecxMsoNormal, .ExternalClass div.ecxMsoNormal
{margin-bottom:.0001pt;font-size:11.0pt;font-family:"Calibri","sans-serif";}
.ExternalClass a:link, .ExternalClass span.ecxMsoHyperlink
{color:blue;text-decoration:underline;}
.ExternalClass a:visited, .ExternalClass span.ecxMsoHyperlinkFollowed
{color:purple;text-decoration:underline;}
.ExternalClass span.ecxEmailStyle17
{font-family:"Calibri","sans-serif";color:windowtext;}
.ExternalClass .ecxMsoChpDefault
{font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;}
.ExternalClass div.ecxWordSection1
{page:WordSection1;}
--></STYLE>
<DIV class=ecxWordSection1>
<P class=ecxMsoNormal>Is there a simple way in BlueOnyx to auto-block hosts that fail to login via SSH too many times? Something similar to the Failed Logins settings for the BlueOnyx login page but for SSH?</P>
<P class=ecxMsoNormal> </P>
<P class=ecxMsoNormal>thanks</P></DIV><BR>_______________________________________________ Blueonyx mailing list Blueonyx@mail.blueonyx.it http://mail.blueonyx.it/mailman/listinfo/blueonyx</DIV> </div></body>
</html>