ssh login monitoring

Yomaoni · 09-07-2005, 04:57 PM

Hello all,

I have a question, I have a mail server running qmail and squarrelmail off of our DS3. Lately someone has been attempting to brute force his/her way into the server using ssh. We are currently using portsentry on the server but they are not using any scanning software so they haven't been blacklisted yet. I've heard of some software out there that will watch the logon attempts and if you try to many times then it will add you to the iptables and set your IP to be dropped. Has anyone ever heard of this or something similar? Thanks for the help.

UnderDark · 09-07-2005, 06:32 PM

try this

Code:

cat /var/log/messages | grep Fail

int0x80 · 09-08-2005, 10:10 AM

Try reading the sticky in the forum
http://www.linuxquestions.org/questi...hreadid=340366