看板FB_security
標 題Re: Attacks on ssh port
發信站NCTU CSIE FreeBSD Server (Mon Sep 27 05:04:21 2004)
轉信站ptt!FreeBSD.csie.NCTU!not-for-mail
David D.W. Downey wrote:
>On Fri, 24 Sep 2004 23:49:09 +0200, Alex de Kruijff
><
[email protected]> wrote:
>
>
>>>Then you can still see the attempts (and thus log the IP information
>>>for contacting the abuse@ for the responsible IP controller) while
>>>limiting your log sizes.
>>>
>>>
>>This only logs the first tree catches (when the log attribuut is set)
>>per rule. You may want to set this a little higher like 100.
>>
>>
>>
>
>while I agree my example of 3 was low (meant only to instruct) I would
>say more along the lines of 25. if someone is hitting you 25 times in
>a row and getting tagged by that rule, you can bet your butt it's not
>a client of your's.
>
It is even simpler:
Anybody trying to use root as user for ssh-login is not a customer
of mine....
And if he has not figured out that he's doing something wrong after
3 tries, little chance that he is really just making a mistake.
--WjW
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "
[email protected]"