Re: failed root login attempts
In article <[🔎] 20040919183057.GA22093@cirrus.madduck.net> you wrote:
> Other than blacklisting the IPs (which is a race I am going to
> lose), what are people doing? Are there any distinctive marks in the
> SSH login attempt that one could filter on?
You can either move your ssh to another port, that will greatly reduce the
distributed brute force attacks, or you can put a filter with port knocking
in front of it. Another option is to turn off password authentication,
completely.
And yes you should be worried about those attacks if you habe weak passwords.
Bernd
--
eckes privat - http://www.eckes.org/
Project Freefire - http://www.freefire.org/
Reply to: