deny ip address with ssh

IRIGHTI · 05-12-2005, 11:22 PM

Quote:

Originally posted by gbonvehi
You may want to try this: http://freshmeat.net/projects/blockh...ease_id=195611

By the way, IRIGHTI that script won't work as it is (just need to change the directory init.d) in a default Slackware install since Slackware doesn't use SysV init scripts as default so init.d doesn't exist.

Whoops, I was in Gentoo when I posted that. I have a slackware script as well, the log it parses is /var/log/messages in that one along with your change.

Tinkster · 05-31-2005, 08:40 PM

I quite like blockhosts approach ... the neat thing is
that it gets launched whenever an ssh connection is
attempted, scans the file(s) you configured and blocks
the IP using the tcp wrappers, that is it edits your
/etc/hosts.allow (.deny - whatever makes your skirt
rise). You can (to avoid blocking a million hosts in
the end) set an expiration - by default a host will be
blocked for 12 hours. Very clever. :}

Cheers,
Tink