Date: Tue, 06 May 2008 13:57:19 -0400 From: Randy Ramsdell <rramsdell@livedatagroup.com> To: freebsd-questions@freebsd.org Subject: Re: [SSHd] Increasing wait time? Message-ID: <48209BFF.6090607@livedatagroup.com> In-Reply-To: <20080506173912.GB85015@Grumpy.DynDNS.org> References: <q7412457qoumm8v8dbth10fug2ctbrlfp0@4ax.com> <200805060931.18936.beech@freebsd.org> <20080506173912.GB85015@Grumpy.DynDNS.org>
next in thread | previous in thread | raw e-mail | index | archive | help
David Kelly wrote: > On Tue, May 06, 2008 at 09:31:15AM -0800, Beech Rintoul wrote: > >>> Is there a way to configure SSHd, so that the wait time between >>> login attempts increases after X failed tries? >>> >> Not that I know of. You should look into denyhosts (in the ports) it >> works well and even has a RBL feature to block some of these script >> kiddies proactively. Unfortunately, these attempts have become a fact >> of life. I probably get 20 - 30 attempts a day between my various >> servers. >> > > Depending on how you use ssh from external systems you could add > firewall rules to disallow all but known sources. > > I used portsentry several years ago which is a realtime portscan blocker. It would trigger on this type of ssh portscan for sure. One problem is that it blocks using firewall rules, hosts.deny etc... and would have to be actively maintained. Meaning: I cleaned these entries once a week. I am not sure it is ported to BSD either.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?48209BFF.6090607>