break-in attempts on my server
Rajiv Aaron Manglani
rajiv at alum.mit.edu
Sun Nov 20 21:42:01 EST 2005
> Is there *anything* else I can do? There's hundreds of these
> attempts.
i block these attempts on my machine using http://www.sshblack.com/
"The sshblack script is a real-time security tool for secure shell
(ssh). It monitors *nix log files for suspicious activity and reacts
appropriately to aggressive attackers by adding them to a "blacklist"
created using various firewalling tools -- such as iptables --
available in most modern versions of Unix and Linux. The blacklist is
simply a list of source IP addresses that are prohibited from making
ssh connections to the protected host. Once a predetermined amount of
time has passed, the offending IP address is removed from the
blacklist."
More information about the Discuss
mailing list