[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: POSSIBLE BREAK-IN in auth.log via ssh



Raquel wrote:
On Thu, 12 Feb 2009 19:40:16 +1100
Alex Samad <alex@samad.com.au> wrote:

this is ssh complaining about incorrect password being supplied, I
presume you do not allow password authentication for root !

This is some script kiddie or mutant pc try brute attack against
your sshd server, try fail2ban

I used to blacklist all those in my firewall.  Then I installed
fail2ban.  I don't have to spend the time with the firewall and the
breakin attempts have dropped dramatically, to the point where I
seldom see one any more.

My advice is to install fail2ban.


For ssh dictionary attacks, another package you might consider is DenyHost. (http://denyhosts.sourceforge.net/)

--
ptader (at)
www.linuxscope.com


Reply to: