Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Preventing brute force attacks against ssh?

We have approximately 20 internet connected virtual machines, and just noticed that hackers are trying to brute force SSH port 22. They are trying common usernames (root, mysql, admin) and dictionary attacks.

We know one counter-measure is to run SSH on a different port, but that is not an option (must run on 22). Also, we know that disallowing passwords (only public-keys) is another counter-measure, but again, we require the ability to use password authentication.

Is there a package that can ban/block an ip-address if it tries to SSH incorrectly X number of times in a given interval?

Would be optimal if it could block for say 12 hours if 5 incorrect logins in a span of 1 minute.


share|improve this question

marked as duplicate by EEAA, Shane Madden, Wesley, gWaldo, Ward Jan 31 '12 at 3:21

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

and – gWaldo Jan 31 '12 at 2:54
works for any log files, based on any phrases

share|improve this answer

share|improve this answer
-1 for posting just a link. – John Gardeniers Jan 31 '12 at 3:28
My bad, noted :) – chocripple Jan 31 '12 at 4:19

I use the CSF (ConfigServer Security & Firewall) scripts, which not only includes IP filtering, but also a plethora of other functionality. It integrates with IP Tables nicely. I run, manage, and configure it from the command line, but for folks who have cPanel, it can also be installed via WHM's GUI.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.