From owner-freebsd-questions@FreeBSD.ORG Sun Aug 28 00:29:09 2005 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id BE52016A41F for ; Sun, 28 Aug 2005 00:29:09 +0000 (GMT) (envelope-from freebsd-questions@auscert.org.au) Received: from titania.auscert.org.au (gw.auscert.org.au [203.5.112.28]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3399E43E85 for ; Sun, 28 Aug 2005 00:29:08 +0000 (GMT) (envelope-from freebsd-questions@auscert.org.au) Received: from app.auscert.org.au (app [10.0.1.192]) by titania.auscert.org.au (8.12.10/8.12.10) with ESMTP id j7S0T0qA017492 for ; Sun, 28 Aug 2005 10:29:00 +1000 (EST) Received: from app.auscert.org.au (localhost.auscert.org.au [127.0.0.1]) by app.auscert.org.au (8.13.1/8.13.1) with ESMTP id j7S0T7X4043956 for ; Sun, 28 Aug 2005 10:29:07 +1000 (EST) (envelope-from freebsd-questions@auscert.org.au) Message-Id: <200508280029.j7S0T7X4043956@app.auscert.org.au> To: freebsd-questions@freebsd.org from: freebsd-questions@auscert.org.au In-Reply-To: Your message of "Sat, 27 Aug 2005 19:59:40 -0400." <4310FE6C.6050401@nawcom.no-ip.com> Date: Sun, 28 Aug 2005 10:29:07 +1000 Subject: Re: Illegal access attempt - FreeBSD 5.4 Release - please advise X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Aug 2005 00:29:09 -0000 > -if the attempt was with a username that doesnt exist - i add the ip to > a db of banned ips and flush and restart ipfw I'm curious about this bit - what do you do about accidentally mistyped usernames by valid users? cheers, -- Joel Hatton -- Security Analyst | Hotline: +61 7 3365 4417 AusCERT - Australia's national CERT | Fax: +61 7 3365 7031 The University of Queensland | WWW: www.auscert.org.au Qld 4072 Australia | Email: auscert@auscert.org.au