Ssh

Joshsmac · 04-16-2006, 12:14 AM

is there a way in linux to secure sshd in such a way that there is a max number of tries to login and the ip is either banned temporarily for a set time or permanently?

basically to keep some guy from some ip trying multiple user names to guess a login. I don't know what thats called but thats what i would like to prevent.

jschiwal · 04-16-2006, 01:16 AM

Try looking in the "man 5 sshd_config" manpage. There are options to allow and deny users. Also, your system may also use PAM authentication.

I don't know if this would work by you could try "DenyUsers *@<ipaddress>"

Try to do a reverse lookup on the IP address. If it is successful, then you can use "DenyUsers *@HisHostname"

Also, if you know from the logs what his IP address is you could block it at the firewall. This will prevent him from attacking other services.

pk21 · 04-17-2006, 04:59 AM

Read http://www.linuxquestions.org/questi...=340366&page=3

Capt_Caveman mentioned http://denyhosts.sourceforge.net/features.html which has the ability to temporary deny hosts. (haven't tested it myself)