logwatch failing on mail to user

[Claude Jones]

On Sun December 10 2006 11:48 pm, Tim wrote:
> Gee, an e-mail for each incursion?  You could get swamped.

So far, denyhosts works quite well for me. I've been using it on multiple 
servers for about 1.5 years now. Sometimes, I may get hit by up to ten or so 
attempts from different hosts that generate blocks; that's not so bad. 
Usually, it's far less than that. I've got mine set up to trip after 5 
failures - I think the denyhosts daemon is checking the logs every 60 
seconds, so, someone may get a couple of extra attempts in after the 5 before 
he's picked up. But once he's added to hosts.deny, he's history for awhile. 
The hosts.deny list seems to hover around 100 hosts at any given point, and 
ssh still seems fairly snappy when I connect, so I'm happy. 
-- 
Claude Jones
Brunswick, MD, USA