[svlug] Need a script that will add pwdfail IPs to shorewall blacklist

[Breen Mullins]

On Sat, Nov 05, 2005 at 11:17:36AM -0800, David E. Fox wrote:
> I haven't run across something writing to that file, but I too had
> numerous failed attempts (ssh attacks) recently - these were logged
> into /var/log/auth.log. Doing some greps I found attempts from one or
> two places (whois pointed to somewhere in Korea) in the hundreds if not
> thousands of lines. These were looking for "typical" accounts on a
> system. 
> 

My current high-water mark for ssh attempts is 4444 from a single IP.

Attempts have dropped to almost nil since I put all of APNIC's /8s into 
/etc/sysconfig/iptables.

Breen
-- 
Breen Mullins
Menlo Park, California