Hi all
how i can automatic denyy ip when some one do ssh bruteforce ....

Welcome to LQ!

There is a sticky post in the LQ Security forum that talks about this issue. There is a link in the last post of that thread that is extremely comprehensive. http://www.linuxquestions.org/questi...ml#post2027930

Look at Fail2Ban as it should serve your needs.

2 members found this post helpful.

but i have script deny ssh bruteforce check it out
#!/bin/bash
#This script will monitor for failed login attempts and after a specified number of times add the ip to a deny list
#Chad
LOGFILE=”/var/log/secure”
HOSTSDENY=”/etc/hosts.deny”
BADCOUNT=”5"
# read logfile and look for invalid login attemps
grep sshd $LOGFILE |grep “Invalid user”| awk ‘{print $NF}’|sort|uniq -c|sort -n|sed “s/[[:space:]]*//” | while
read i
do
# read number of failed attempts
count=`echo $i | cut -d” ” -f1`
# read ip address from failed attempt
ip=`echo $i | cut -d” ” -f2`
#check hostdeny file to see if IP already exist
already=`grep $ip $HOSTSDENY | grep sshd`
#if IP does not exist add it to hostdeny file
if [ -z "$already" ]
then
if [ "$count" -ge "$BADCOUNT" ]
then
echo “sshd: “$ip >> $HOSTSDENY
fi
fi
done


so how about this script .....

Depending on your distro...

But on Red Hat systems (RHEL/CentOS/Fedora) you can edit the /etc/hosts.allow and the /etc/hosts.deny files

-C

my distro fedora 12, can you try thiss script work or not in system because i do with this script not work in fedora 12.....
can you help me .....

Fedora 12 is an old distro. I would recommend upgrading to Fedora 17

Once you have that you can follow this example:

Let's say you want to deny the 192.168.2.54 address but allow all others

/etc/hosts.deny
/etc/hosts.allow
-C

but i want to aoutomatic deny ip when someone attack my server with ssh bruteforce ....

Without writing the script for you

Something like

I'm sure you can fit that in with what you've already written....the white space in the sed statement is a TAB.

-C

Like someone else said before. Use fail2ban. That should serve your purpose. It will ban an IP after a specified number of attempts, and lock them out for a specified time.

are u sure fail2ban can deny ip automatic ....
can you explain step by step how to configuration fail2ban, because i not understand how to use fail2ban ....
sory my english bad, i from indonesia help me please !

Yeah, I have set fail2ban up on a few servers, it is very easy to install/administer.

I haven't used fedora much, so if im wrong with anything just let me know.

Once it is finished installing, go into the /etc/fail2ban/jail.conf and configure with what you would like.

You can change the maxretry (the amount of times someone can try to login) and the bantime (how long the IP will be banned for).

There are lots of other settings in there too that you can tweak to fit what you want to do.

This may be helpful for you: http://www.howtoforge.com/preventing...ban-on-fedora9

thank you friend ....

No problem. Good Luck