<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> Seconded regarding denyhosts; it is very nice. In addition, I also allow SSH connections only from certain subnets--yes, even on the trusted network. Kids are quite inventive, you know. Just throw up a couple of iptables lines like this: # Permit only 192.168.1.0/24 to SSH to us iptables -A INPUT -i eth0 -p tcp --source 192.168.1.0/24 --destination-port 22 -j ACCEPT # Deny everything else on TCP 22 iptables -A INPUT -i eth0 -p tcp --destination-port 22 -j DROP And you can add any other self-protection rules that you like. --TP <div class="moz-signature">_______________________________ Do you <a href="http://www.gnu.org">GNU</a>? <a href="http://www.cmosnetworks.com">Microsoft Free since 2003</a>--the ultimate antivirus protection! </div> Michael Blinn wrote: <blockquote cite="mid477B9E89.9060706@peopleplaces.org" type="cite"> Not true. I use and recommend the package 'denyhosts' - Nice little python script that daemonizes to periodically check /var/log/secure, adding IPs from brute-force attackers to /etc/hosts.deny, then emails me its actions. You can also set an auto-expire time for those blocks. I love it. -Michael Les Mikesell wrote: <blockquote type="cite">There is quite a lot of ssh password guessing going on over the internet. If you have systems with the ssh port exposed, you can expect to see a few hundred attempts a day in the logs - a slow enough rate that you might not notice but the attackers are probably spreading their attempts over thousands of systems. There are some packages that watch the logs and firewall addresses with repeated failed attempts but none are included in the distribution. </blockquote> </blockquote> </body> </html>