[nycbug-talk] Fwd: Stopping SSH dictionary attacks?

[G. Rosamond]

Begin forwarded message:

> From: "Juan J. Martinez" <reidrac at usebox.net>
> Date: December 21, 2004 1:14:29 PM EST
> To: misc at openbsd.org
> Subject: Re: Stopping SSH dictionary attacks?
>
>> One solution I'm considering is writing a script that parses authlog 
>> every hour or so and adds any IPs with more than x failed login 
>> attempts to ipcop/etc/hosts_deny, am I on the right track with this 
>> (has someone already done it - I'm a big fan of not re-inventing the 
>> wheel)?
>
> Actually I've done this... however I think its usefulness is limited 
> (ie. scans from the same IP in different days are rare), but was fun 
> to code.
>
> You can check it at (the package is ssh_blocker):
> http://blackshell.usebox.net/pub/shell/
>
> Juanjo
>
> -- 
> Desarrollo y Sistemas: http://usebox.net/
>       P?gina personal: http://usebox.net/jjm/
>
>

This may be relevant to some earlier discussions about openssh security 
and brute force/dictionary attacks.

g