I ONLY had my FC5 up for 2 days and by looking at the security log i could see that someone is trying to hack into my machine which is very clear that he is trying to figure out the user name by trying different IDs - how do i stop that person by blocking his IP since its listed here?

Thanks

cat /var/log/secure
Apr 24 08:38:13 black sshd[2601]: Invalid user user from 65.98.23.225
Apr 24 12:38:13 black sshd[2602]: input_userauth_request: invalid user user
Apr 24 08:38:13 black sshd[2601]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:13 black sshd[2601]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:13 black sshd[2601]: pam_succeed_if(sshd:auth): error retrieving information about user user
Apr 24 08:38:15 black sshd[2601]: Failed password for invalid user user from 65.98.23.225 port 52481 ssh2
Apr 24 12:38:15 black sshd[2602]: Failed password for invalid user user from 65.98.23.225 port 52481 ssh2
Apr 24 12:38:15 black sshd[2602]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:15 black sshd[2661]: Invalid user user from 65.98.23.225
Apr 24 12:38:15 black sshd[2662]: input_userauth_request: invalid user user
Apr 24 08:38:15 black sshd[2661]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:15 black sshd[2661]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:15 black sshd[2661]: pam_succeed_if(sshd:auth): error retrieving information about user user
Apr 24 08:38:17 black sshd[2661]: Failed password for invalid user user from 65.98.23.225 port 52507 ssh2
Apr 24 12:38:17 black sshd[2662]: Failed password for invalid user user from 65.98.23.225 port 52507 ssh2
Apr 24 12:38:17 black sshd[2662]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:18 black sshd[2701]: Invalid user user from 65.98.23.225
Apr 24 12:38:18 black sshd[2702]: input_userauth_request: invalid user user
Apr 24 08:38:18 black sshd[2701]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:18 black sshd[2701]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:18 black sshd[2701]: pam_succeed_if(sshd:auth): error retrieving information about user user
Apr 24 08:38:20 black sshd[2701]: Failed password for invalid user user from 65.98.23.225 port 52544 ssh2
Apr 24 12:38:20 black sshd[2702]: Failed password for invalid user user from 65.98.23.225 port 52544 ssh2
Apr 24 12:38:20 black sshd[2702]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:20 black sshd[2703]: Invalid user web from 65.98.23.225
Apr 24 12:38:20 black sshd[2704]: input_userauth_request: invalid user web
Apr 24 08:38:20 black sshd[2703]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:20 black sshd[2703]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:20 black sshd[2703]: pam_succeed_if(sshd:auth): error retrieving information about user web
Apr 24 08:38:22 black sshd[2703]: Failed password for invalid user web from 65.98.23.225 port 52581 ssh2
Apr 24 12:38:22 black sshd[2704]: Failed password for invalid user web from 65.98.23.225 port 52581 ssh2
Apr 24 12:38:22 black sshd[2704]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:22 black sshd[2705]: Invalid user web from 65.98.23.225
Apr 24 12:38:22 black sshd[2706]: input_userauth_request: invalid user web
Apr 24 08:38:22 black sshd[2705]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:22 black sshd[2705]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:22 black sshd[2705]: pam_succeed_if(sshd:auth): error retrieving information about user web
Apr 24 08:38:24 black sshd[2705]: Failed password for invalid user web from 65.98.23.225 port 52603 ssh2
Apr 24 12:38:24 black sshd[2706]: Failed password for invalid user web from 65.98.23.225 port 52603 ssh2
Apr 24 12:38:24 black sshd[2706]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:24 black sshd[2707]: Invalid user oracle from 65.98.23.225
Apr 24 12:38:24 black sshd[2708]: input_userauth_request: invalid user oracle
Apr 24 08:38:24 black sshd[2707]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:24 black sshd[2707]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:24 black sshd[2707]: pam_succeed_if(sshd:auth): error retrieving information about user oracle
Apr 24 08:38:26 black sshd[2707]: Failed password for invalid user oracle from 65.98.23.225 port 52620 ssh2
Apr 24 12:38:26 black sshd[2708]: Failed password for invalid user oracle from 65.98.23.225 port 52620 ssh2
Apr 24 12:38:26 black sshd[2708]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:26 black sshd[2709]: Invalid user sybase from 65.98.23.225
Apr 24 12:38:26 black sshd[2710]: input_userauth_request: invalid user sybase
Apr 24 08:38:26 black sshd[2709]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:26 black sshd[2709]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:26 black sshd[2709]: pam_succeed_if(sshd:auth): error retrieving information about user sybase
Apr 24 08:38:28 black sshd[2709]: Failed password for invalid user sybase from 65.98.23.225 port 52637 ssh2
Apr 24 12:38:28 black sshd[2710]: Failed password for invalid user sybase from 65.98.23.225 port 52637 ssh2
Apr 24 12:38:28 black sshd[2710]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:28 black sshd[2711]: Invalid user master from 65.98.23.225
Apr 24 12:38:28 black sshd[2712]: input_userauth_request: invalid user master
Apr 24 08:38:28 black sshd[2711]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:28 black sshd[2711]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:28 black sshd[2711]: pam_succeed_if(sshd:auth): error retrieving information about user master
Apr 24 08:38:30 black sshd[2711]: Failed password for invalid user master from 65.98.23.225 port 52655 ssh2
Apr 24 12:38:30 black sshd[2712]: Failed password for invalid user master from 65.98.23.225 port 52655 ssh2
Apr 24 12:38:30 black sshd[2712]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:31 black sshd[2713]: Invalid user account from 65.98.23.225
Apr 24 12:38:31 black sshd[2714]: input_userauth_request: invalid user account
Apr 24 08:38:31 black sshd[2713]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:31 black sshd[2713]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:31 black sshd[2713]: pam_succeed_if(sshd:auth): error retrieving information about user account
Apr 24 08:38:33 black sshd[2713]: Failed password for invalid user account from 65.98.23.225 port 52676 ssh2
Apr 24 12:38:33 black sshd[2714]: Failed password for invalid user account from 65.98.23.225 port 52676 ssh2
Apr 24 12:38:33 black sshd[2714]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:33 black sshd[2716]: Invalid user backup from 65.98.23.225
Apr 24 12:38:33 black sshd[2717]: input_userauth_request: invalid user backup
Apr 24 08:38:33 black sshd[2716]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:33 black sshd[2716]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:33 black sshd[2716]: pam_succeed_if(sshd:auth): error retrieving information about user backup
Apr 24 08:38:36 black sshd[2716]: Failed password for invalid user backup from 65.98.23.225 port 52699 ssh2
Apr 24 12:38:36 black sshd[2717]: Failed password for invalid user backup from 65.98.23.225 port 52699 ssh2
Apr 24 12:38:36 black sshd[2717]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:36 black sshd[2777]: Invalid user server from 65.98.23.225
Apr 24 12:38:36 black sshd[2778]: input_userauth_request: invalid user server
Apr 24 08:38:36 black sshd[2777]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:36 black sshd[2777]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:36 black sshd[2777]: pam_succeed_if(sshd:auth): error retrieving information about user server
Apr 24 08:38:37 black sshd[2777]: Failed password for invalid user server from 65.98.23.225 port 52721 ssh2
Apr 24 12:38:37 black sshd[2778]: Failed password for invalid user server from 65.98.23.225 port 52721 ssh2
Apr 24 12:38:37 black sshd[2778]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:37 black sshd[2780]: Invalid user adam from 65.98.23.225
Apr 24 12:38:38 black sshd[2781]: input_userauth_request: invalid user adam
Apr 24 08:38:38 black sshd[2780]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:38 black sshd[2780]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:38 black sshd[2780]: pam_succeed_if(sshd:auth): error retrieving information about user adam
Apr 24 08:38:39 black sshd[2780]: Failed password for invalid user adam from 65.98.23.225 port 52737 ssh2
Apr 24 12:38:39 black sshd[2781]: Failed password for invalid user adam from 65.98.23.225 port 52737 ssh2
Apr 24 12:38:39 black sshd[2781]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:40 black sshd[2782]: Invalid user alan from 65.98.23.225
Apr 24 12:38:40 black sshd[2783]: input_userauth_request: invalid user alan
Apr 24 08:38:40 black sshd[2782]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:40 black sshd[2782]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:40 black sshd[2782]: pam_succeed_if(sshd:auth): error retrieving information about user alan
Apr 24 08:38:42 black sshd[2782]: Failed password for invalid user alan from 65.98.23.225 port 52756 ssh2
Apr 24 12:38:42 black sshd[2783]: Failed password for invalid user alan from 65.98.23.225 port 52756 ssh2
Apr 24 12:38:42 black sshd[2783]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:42 black sshd[2784]: Invalid user frank from 65.98.23.225
Apr 24 12:38:42 black sshd[2785]: input_userauth_request: invalid user frank
Apr 24 08:38:42 black sshd[2784]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:42 black sshd[2784]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:42 black sshd[2784]: pam_succeed_if(sshd:auth): error retrieving information about user frank
Apr 24 08:38:44 black sshd[2784]: Failed password for invalid user frank from 65.98.23.225 port 52777 ssh2
Apr 24 12:38:44 black sshd[2785]: Failed password for invalid user frank from 65.98.23.225 port 52777 ssh2
Apr 24 12:38:44 black sshd[2785]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:44 black sshd[2786]: Invalid user george from 65.98.23.225
Apr 24 12:38:44 black sshd[2787]: input_userauth_request: invalid user george
Apr 24 08:38:45 black sshd[2786]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:45 black sshd[2786]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:45 black sshd[2786]: pam_succeed_if(sshd:auth): error retrieving information about user george
Apr 24 08:38:47 black sshd[2786]: Failed password for invalid user george from 65.98.23.225 port 52797 ssh2
Apr 24 12:38:47 black sshd[2787]: Failed password for invalid user george from 65.98.23.225 port 52797 ssh2
Apr 24 12:38:47 black sshd[2787]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:47 black sshd[2791]: Invalid user henry from 65.98.23.225
Apr 24 12:38:47 black sshd[2792]: input_userauth_request: invalid user henry
Apr 24 08:38:47 black sshd[2791]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:47 black sshd[2791]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:47 black sshd[2791]: pam_succeed_if(sshd:auth): error retrieving information about user henry
Apr 24 08:38:49 black sshd[2791]: Failed password for invalid user henry from 65.98.23.225 port 52826 ssh2
Apr 24 12:38:49 black sshd[2792]: Failed password for invalid user henry from 65.98.23.225 port 52826 ssh2
Apr 24 12:38:49 black sshd[2792]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:50 black sshd[2795]: Invalid user john from 65.98.23.225
Apr 24 12:38:50 black sshd[2796]: input_userauth_request: invalid user john
Apr 24 08:38:50 black sshd[2795]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:38:50 black sshd[2795]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:38:50 black sshd[2795]: pam_succeed_if(sshd:auth): error retrieving information about user john
Apr 24 08:38:52 black sshd[2795]: Failed password for invalid user john from 65.98.23.225 port 52844 ssh2
Apr 24 12:38:52 black sshd[2796]: Failed password for invalid user john from 65.98.23.225 port 52844 ssh2
Apr 24 12:38:52 black sshd[2796]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:52 black su: pam_unix(su:session): session opened for user root by mina(uid=500)
Apr 24 08:38:52 black sshd[2798]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225 user=root
Apr 24 08:38:54 black sshd[2798]: Failed password for root from 65.98.23.225 port 52863 ssh2
Apr 24 12:38:54 black sshd[2799]: Failed password for root from 65.98.23.225 port 52863 ssh2
Apr 24 12:38:54 black sshd[2799]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:54 black sshd[2812]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225 user=root
Apr 24 08:38:56 black sshd[2812]: Failed password for root from 65.98.23.225 port 52883 ssh2
Apr 24 12:38:56 black sshd[2813]: Failed password for root from 65.98.23.225 port 52883 ssh2
Apr 24 12:38:56 black sshd[2813]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:56 black sshd[2815]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225 user=root
Apr 24 08:38:59 black sshd[2815]: Failed password for root from 65.98.23.225 port 52896 ssh2
Apr 24 12:38:59 black sshd[2816]: Failed password for root from 65.98.23.225 port 52896 ssh2
Apr 24 12:38:59 black sshd[2816]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:38:59 black sshd[2830]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225 user=root
Apr 24 08:39:01 black sshd[2830]: Failed password for root from 65.98.23.225 port 52915 ssh2
Apr 24 12:39:01 black sshd[2831]: Failed password for root from 65.98.23.225 port 52915 ssh2
Apr 24 12:39:01 black sshd[2831]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:39:01 black sshd[2833]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225 user=root
Apr 24 08:39:03 black sshd[2833]: Failed password for root from 65.98.23.225 port 52935 ssh2
Apr 24 12:39:03 black sshd[2834]: Failed password for root from 65.98.23.225 port 52935 ssh2
Apr 24 12:39:03 black sshd[2834]: Received disconnect from 65.98.23.225: 11: Bye Bye
Apr 24 08:39:04 black sshd[2836]: Invalid user test from 65.98.23.225
Apr 24 12:39:04 black sshd[2837]: input_userauth_request: invalid user test
Apr 24 08:39:04 black sshd[2836]: pam_unix(sshd:auth): check pass; user unknown
Apr 24 08:39:04 black sshd[2836]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=65.98.23.225
Apr 24 08:39:04 black sshd[2836]: pam_succeed_if(sshd:auth): error retrieving information about user test
Apr 24 08:39:06 black sshd[2836]: Failed password for invalid user test from 65.98.23.225 port 52957 ssh2
Apr 24 12:39:06 black sshd[2837]: Failed password for invalid user test from 65.98.23.225 port 52957 ssh2
Apr 24 12:39:06 black sshd[2837]: Received disconnect from 65.98.23.225: 11: Bye Bye

You could disable remote logins
You can use iptables to add a line which will drop anything sourced from his IP.
It's always the same, which is a bit silly. It may just be a mistake - someone constantly querying the wrong IP.

65.98.23.255 is owned by Pegasus Web Technologies - you may want to let them know.

... from http://ws.arin.net/cgi-bin/whois.pl
OrgName: Pegasus Web Technologies
OrgID: PWT-5
Address: 1719 Route 10E
Address: Suite 220
City: Parsippany
StateProv: NJ
PostalCode: 07054
Country: US

ReferralServer: rwhois://rwhois.fortressitx.com:4321/

NetRange: 65.98.0.0 - 65.98.127.255
CIDR: 65.98.0.0/17
NetName: PEGASUSHOST
NetHandle: NET-65-98-0-0-1
Parent: NET-65-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.PWEBTECH.COM
NameServer: NS2.PWEBTECH.COM
Comment:
RegDate: 2004-07-21
Updated: 2005-09-16

RAbuseHandle: PWTAC-ARIN
RAbuseName: Pegasus Web Technologies Abuse Coordinator
RAbusePhone: +1-973-294-2021
RAbuseEmail: abuse@pwebtech.com

RTechHandle: PWTH-ARIN
RTechName: Pegasus Web Technologies Hostmaster
RTechPhone: +1-973-294-2021
RTechEmail: hostmaster@pwebtech.com

OrgAbuseHandle: PWTAC-ARIN
OrgAbuseName: Pegasus Web Technologies Abuse Coordinator
OrgAbusePhone: +1-973-294-2021
OrgAbuseEmail: abuse@pwebtech.com

OrgNOCHandle: PWTH-ARIN
OrgNOCName: Pegasus Web Technologies Hostmaster
OrgNOCPhone: +1-973-294-2021
OrgNOCEmail: hostmaster@pwebtech.com

OrgTechHandle: PWTH-ARIN
OrgTechName: Pegasus Web Technologies Hostmaster
OrgTechPhone: +1-973-294-2021
OrgTechEmail: hostmaster@pwebtech.com

Another nice idea to prevent such login attempts is to make sshd listen on a different port. Choose any port that is not being used. Also, make sure you disallow root to login via ssh.

Thank you all for your responses

You can also try this:
http://www.csc.liv.ac.uk/~greg/sshdfilter/

You know, there's a central thread with all the port-blocking apps mentioned in this forum, here: http://www.linuxquestions.org/questi...d.php?t=340366