4 ms·
As others mentioned, prevent password logins. I also recommend fail2ban[0] for completely blocking IPs after detecting repeat failed access attempts. [0] http:
by gingerlime 11y ago
As others mentioned, prevent password logins. I also recommend fail2ban[0] for completely blocking IPs after detecting repeat failed access attempts.
[0] http://www.fail2ban.org/ http://www.fail2ban.org/
- IE6 11y agoFail2Ban is great - I've used it for more than just blocking brute force attacks on ssh (although a real security expert might say this is the wrong tool to use).
- gingerlime 11y agoYep, I also use it to detect repeat errors on our own application logs and block offending IPs. Fail2ban has a reasonably easy to tweak detection and blocking rules, plus lots of available ready-made ones that do the job. If you're comfortable with regular expressions (which most people on HN probably are), then it's really straight-forward to write your own rules. The only problem I encountered with it is when you start it up and you have a huge amount of data in your log files. It can cause 100% cpu usage for a long time until it digests the whole thing...