<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><base href="x-msg://966/"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Ballontekst Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
p.ecxmsonormal, li.ecxmsonormal, div.ecxmsonormal
{mso-style-name:ecxmsonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.E-mailStijl19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BallontekstChar
{mso-style-name:"Ballontekst Char";
mso-style-priority:99;
mso-style-link:Ballontekst;
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=NL link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Hello Greg,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Is the DFIX allready for 5107, in the past ity only worked on 5106<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Thanxs<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><br>Steffan<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Van:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> blueonyx-bounces@mail.blueonyx.it [mailto:blueonyx-bounces@mail.blueonyx.it] <b>Namens </b>Greg Kuhnert<br><b>Verzonden:</b> woensdag 9 januari 2013 20:43<br><b>Aan:</b> BlueOnyx General Mailing List<br><b>Onderwerp:</b> [BlueOnyx:11954] Re: Blocking brute force SSH login attempts<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>DFIX is a free product available from the new combined Compass / BlueOnyx / Solarspeed stores. It blocks SSH brute force attacks and much more. To get DFIX, you will need to register to one of the stores if you have not already done so, and "purchase" the free bundle for $0. You can then install via NewLinQ.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Note: Anyone who has previously had an account with either Solarspeed or Compass, you should first try to reset your password in the new store - and then connect to NewLinQ using the instructions at the link below. It is important for all clients to perform this step to get access to any updates/patches for any of your purchases.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>The instructions to connect to NewLinQ are here. <a href="http://www.compassnetworks.com.au/delivery">http://www.compassnetworks.com.au/delivery</a><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Regards,<o:p></o:p></p></div><div><p class=MsoNormal>Greg.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>On 10/01/2013, at 1:14 AM, Fungal Style <<a href="mailto:wayin@hotmail.com">wayin@hotmail.com</a>> wrote:<o:p></o:p></p></div><p class=MsoNormal><br><br><o:p></o:p></p><div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>As far as I know... yes and no....<br> <br>BO will block accounts and IPs that are attempted to be brute forced, but the account needs to exist, well that has been my experience....<br> <br>I tend to use the iptables and block /32 or if it is from China or other known hacking countries then a /24 is a minimum...<span class=apple-converted-space> </span><br> <br>I have been thinking of routing everything through a firewall or sorts so that the hackers will usually hit it first then get the IP blocked (as all other servers would be on a virtual LAN)... or something like that.... but it needs more thought at this stage and I just dont have the time to look too far into it.<br> <br>If anyone has a good solution (preferrably free) then I am open to suggestions too (much like most on this list I would assume).<br> <br>HTH<br> <br>Brian<br> <o:p></o:p></span></p><div><div class=MsoNormal align=center style='text-align:center'><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><hr size=2 width="100%" align=center id=stopSpelling></span></div><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:<span class=apple-converted-space> </span><a href="mailto:james@slor.net">james@slor.net</a><br>To:<span class=apple-converted-space> </span><a href="mailto:blueonyx@blueonyx.it">blueonyx@blueonyx.it</a><br>Date: Wed, 9 Jan 2013 09:07:31 -0500<br>Subject: [BlueOnyx:11940] Blocking brute force SSH login attempts<o:p></o:p></span></p><div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Is there a simple way in BlueOnyx to auto-block hosts that fail to login via SSH too many times? Something similar to the Failed Logins settings for the BlueOnyx login page but for SSH?<o:p></o:p></span></p></div><p class=ecxmsonormal style='margin:0cm;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> <o:p></o:p></span></p><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>thanks<o:p></o:p></span></p></div></div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'><br>_______________________________________________ Blueonyx mailing list<span class=apple-converted-space> </span><a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a><a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a><o:p></o:p></span></p></div></div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>_______________________________________________<br>Blueonyx mailing list<br><a href="mailto:Blueonyx@mail.blueonyx.it">Blueonyx@mail.blueonyx.it</a><br><a href="http://mail.blueonyx.it/mailman/listinfo/blueonyx">http://mail.blueonyx.it/mailman/listinfo/blueonyx</a><o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>