Too many authentication failures for user - ssh problem

dlugasx · 10-29-2009, 10:23 AM

Quote:

Received disconnect from xx.xxx.xx.xx: 2: Too many authentication failures for user

Does anybody knows what should I do with that command ?

How can I reset failures number on the server.

I have tried with faillog... doesnt work.

hellpp...

alpha01 · 10-29-2009, 07:01 PM

Not sure what you man by "I have tried with faillog... doesnt work." But you can try blocking that ip.

iptables -A INPUT -s XX.XX.XX.2 -j DROP
iptables -A OUTPUT -d xx.xx.xx.2 -j DROP

edenCC · 10-30-2009, 12:01 AM

As for my experience, use a non-standard SSH port is the easiest way to get rid of such noise...

Alternative ways can be used to block these bad eggs directly, e.g. fail2ban