Re: blocking an ip after n failed login attempts

[Radu Florian <rflorian@cs.jhu.edu>]

David N Moore wrote:

> Hi,
> 	I have been poking around with google looking for some ideas
> for a solution to this problem.  Can you think of an easy way to block
> all connections from a certain ip if it tries log in say 5 times and
> fails?  The idea being that it would stop someone from using a
> dictionary-based attack if they had a user-name.
>
> Any input would be appreciated.
>
> -dave

  I would just add the IP address in the /etc/hosts.deny file; 
something like:

portmap: <ip-address>

  would do the trick.

  Hans