From owner-freebsd-questions@FreeBSD.ORG  Sun Jun 22 15:00:25 2014
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 51C499E0
 for <freebsd-questions@freebsd.org>; Sun, 22 Jun 2014 15:00:25 +0000 (UTC)
Received: from mail-vc0-x235.google.com (mail-vc0-x235.google.com
 [IPv6:2607:f8b0:400c:c03::235])
 (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id 14D512C26
 for <freebsd-questions@freebsd.org>; Sun, 22 Jun 2014 15:00:25 +0000 (UTC)
Received: by mail-vc0-f181.google.com with SMTP id il7so4914093vcb.26
 for <freebsd-questions@freebsd.org>; Sun, 22 Jun 2014 08:00:24 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:sender:date:message-id:subject:from:to:content-type;
 bh=C81dLQ9kALPkeZLzrU4ulML1B55UdDSMHVafnmBFFFA=;
 b=xozABO3blP+QUa7ljV7Gdc+P4Ufmn3TvcKoGBM1lpnPMEWS4OS7e75whK6dRIoShWc
 uRL8/vqnN9na09W5/BqTOM5kF6jz0bsgp59MBLnp8aeZFU+Kk4czxJFP/no2rfkyjO7K
 16sqUZhegxC6RC11VAd+IHgnohv9TyBLJrykOV26qGVNvOC7Flnyal4tkUyJF+Bhorb7
 AbnOX4YJfCmTXRA1MyaD/boqCvtE08TKy3HsSdzS0DZBvrgc4m0XO7f24pApDZ4xZAbl
 ulrlDcO3N9wxQAM8X4SebT2PBkVdzUN6hT1TBBEza4eAtBPiaLXhlgi4N/cKQ2+SPSjN
 fZZA==
MIME-Version: 1.0
X-Received: by 10.58.167.168 with SMTP id zp8mr695449veb.33.1403449224196;
 Sun, 22 Jun 2014 08:00:24 -0700 (PDT)
Sender: christopher.maness@gmail.com
Received: by 10.58.191.35 with HTTP; Sun, 22 Jun 2014 08:00:24 -0700 (PDT)
Date: Sun, 22 Jun 2014 08:00:24 -0700
X-Google-Sender-Auth: 8pBfiHCQzunxT5MSI1P5H5VDJ30
Message-ID: <CANnsUMFv06Dot6FDP2Z7enuWcT5ktjJ0BROHkYAnFpEwOmwp2g@mail.gmail.com>
Subject: PAM: Authentication Attack?
From: Chris Maness <chris@chrismaness.com>
To: "freebsd-questions@freebsd.org" <freebsd-questions@freebsd.org>
Content-Type: text/plain; charset=UTF-8
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 22 Jun 2014 15:00:25 -0000

I am running denyhost for failed sshd logins, but I am not sure if it
blocks passwordless PAM attempts.  I am having a lot of hits right now
on PAM failures for my root account.

Any suggestions as far as a good way to deal with this?

Thanks,
Chris