I have root access to a linux machine in office.
From home I need to log in to it using DHCP.
So I cannot only allow accesses from specific IP
addresses. When I check the system log, I found there
were attack attempts from different IPs. I could block
those IPs with "iptables -A INPUT -s harmful_IP -j DROP".

But I still feel unsafe even though I don't allow
root access remotely at all. So I want to know how
to automatically block an IP if there are a certain
amount of unsuccessful login attempts.

Anyone can provide a direction to look into?
Or exact procedures to follow? My linux machine is
running CentOS 4.4.

Thanks!

there's actually tons of tools that do this... here's a few examples:

http://denyhosts.sourceforge.net/

http://www.fail2ban.org/

http://www.aczoom.com/cms/blockhosts/

BTW, this is a very common question... so much so that there's a sticky thread entitled "Failed SSH login attempts" at the top of this forum... not sure if you missed it or something... anyhow, like i said, the links i posted are just a few examples... if you read through the sticky or do some googling i'm sure you can find many more solutions... i hope you find one you like... good luck...

thanks for your help.
yeah, should have looked up similar threads a little bit more.
i tried to search first but was not sure what exactly I should
look for :-)