Re: ssh brute force attacks

Here is a suggestion...
Close port 22 on the firewall, set up a forwarding rule for a public facing "unused" port that maps to your server ip 
and port 22.
Accessing your public ip with "unused" port above will forward request to your server port 22. You can leave 22 
untouched on the inside machine and let the firewall trap external requests for port 22. You can access yor machine from 
the outside via the "unused" port.
Peace,
Allan


Peter Espen wrote:
> On Jan 29, 2011, at 11:33 AM, Wesley J. Landaker wrote:
> 
>> On Saturday, January 29, 2011 10:10:06 Peter Espen wrote:
>>> In addition, I wrote a script that's in crontab and it examines auth.log
>>> and automatically blocks the offending originating IP address via
>>> iptables.
>> You may want to consider using fail2ban, which is a maintained open-source 
>> project that does the same sort of thing:
>>
>> http://www.fail2ban.org/
> 
> Thanks.  However, sshd 22 is the only port I leave open on my personal linux box and something like fail2ban is overkill for me.  Plus, my script does exactly what I want and it was fun to write.
> 
> 
> 
> _______________________________________________
> NMLUG mailing list
> [email protected]
> http://lists.b9.com/cgi-bin/mailman/listinfo/nmlug
> 
> 
_______________________________________________
NMLUG mailing list
[email protected]
http://lists.b9.com/cgi-bin/mailman/listinfo/nmlug