Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This might sound like a bit of a strange question, but I've just taken a sample of over 80 IPs which have failed SSH authentication, and I've mapped them using an online mapping tool.

All of them came from China / Korea... my question is how can I block a range of IPs which would stop these countries being allowed to make SSH requests to my machine, as it's just filling up my logs and wasting traffic.

I'm using shorewall as my firewall if that helps.

share|improve this question

3 Answers 3

To solve this issue people usually implement tools like sshguard or fail2ban.

Find sshguard at: http://www.sshguard.net/
Find fail2ban at: http://www.fail2ban.org/wiki/index.php/Main_Page

share|improve this answer
2  
Fail2ban is SOOOOO easy and SOOOOO good –  Pitto Jan 5 '12 at 10:54
    
This. You don't want to ban SSH access from 'strange foreign places' you want to block SSH access from IPs that are trying to DoS or brute force your system. –  Freiheit Jan 5 '12 at 14:35
    
Remember to add few machines you have access to the whitelist –  Hubert Kario Jan 16 '12 at 12:10
    
Fail2ban even work for httpd and it look promising. +1 for sharing this. –  Azi Jun 20 at 1:31

Use geoip. Xtables is your friend.

share|improve this answer

A generic solution for bruteforce denials is denyhosts. Check it out at http://denyhosts.sourceforge.net/

This will block any IP after a configured count of failed login attempts. It also works for FTP daemons and every other tool that comes with tcp wrapper support.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.