Re: SSH attack
On 10/03/2005 06:14 pm, Marty wrote:
> Jared Hall wrote:
> > It looks like I am being rooted right now. How do I toss this guy off
> > of my system. he has an IP address of 188.8.131.52
> It's a kid! Whois returns "Hanguk Kwangsan Technoledge High School."
I get lots of those, often from Asia and S. America. Block the IP at the
firewall. If you install Portsentry, you can have Portsentry block them
automatically using iptables. IIRC you can have a list of IP addresses that
are exempt from blocking.