Currently I am watching the live auth.log and someone is continuously trying the brute force attack for 10 hours.
Its my local server so no need to worry but I want to test.
I have installed denyhosts.
There is already an entry for that IP address in hosts.deny. But still he is trying the attacks from same IP. System is not blocking that.
Firstly I don't know how did that IP address get entered in that file. I didn't enter it, is there any other system script which can do that.
sshd: 220.127.116.11 sshd: 18.104.22.168
ALL:ALL sshd: ALL
Is there any iptable setting that can override the host.deny file