Re: Reporting brute force ssh login attempts

[John L Fjellstad <john-debian@fjellstad.org>]

Douglas Tutty <dtutty@porchlight.ca> writes:

> Is there a way to configure the firewall to only allow or deny connection
> attempts from certain ip addresses?

I set my firewall to only allow one connection pr minute pr ip address.
So, if you fail the connection, the firewall will drop all connection
from that ip address until there has been at least one minute since last
attempt.  Works great.

Take a look at the recent module in iptables (iptables -m recent --help)

-- 
John L. Fjellstad
web: http://www.fjellstad.org/          Quis custodiet ipsos custodes