<div class="gmail_quote">On Wed, Jan 14, 2009 at 4:24 PM, Derek Broughton <<a href="mailto:derek@pointerstop.ca">derek@pointerstop.ca</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Res wrote: > On Wed, 14 Jan 2009, Anthony M. Rasat wrote: > >> >> My god, so much effort to protect ourselves from SSH Brute Force attack. >> >> Why not using fail2ban (<a href="http://fail2ban.sourceforge.net" target="_blank">http://fail2ban.sourceforge.net</a>)? >> >> I've been using it for more than a couple of years, it works flawlessly >> for my servers. > > This assumes the bad person only uses the same IP, it's better than > nothing, but hardly a real security measure, not to mention all the idiot > users you have that screw up their own passwords, generating more work for > you. For once I agree with Res. _hackers_ don't always use the same IP - that's for the script kiddies. fail2ban is useful - it keeps out specific compromised systems that are being used to attack you, but the hackers are finding new ones faster than you're banning them. And again, Res is right about the users who forget their passwords - you need to have a simple procedure for unbanning their IP at the same time as you reset their password (and remember, if they're using dynamic IPs, you may have already banned a number of different addresses by the time they ask for a password reset - what do you do when a week later the user can't get in because he's been given the IP that is still banned).</blockquote><div> </div></div> The answer to that is straight out of the Denyhosts config file. And there is more but you get the idea. ######################################################################## # # PURGE_DENY: removed HOSTS_DENY entries that are older than this time # when DenyHosts is invoked with the --purge flag # # format is: i[dhwmy] # Where 'i' is an integer (eg. 7) # 'm' = minutes # 'h' = hours # 'd' = days # 'w' = weeks # 'y' = years # # never purge: PURGE_DENY = # # purge entries older than 1 week #PURGE_DENY = 1w # # purge entries older than 5 days #PURGE_DENY = 5d ####################################################################### ####################################################################### # # PURGE_THRESHOLD: defines the maximum times a host will be purged. # Once this value has been exceeded then this host will not be purged. # Setting this parameter to 0 (the default) disables this feature. # # default: a denied host can be purged/re-added indefinitely #PURGE_THRESHOLD = 0 # # a denied host will be purged at most 2 times. #PURGE_THRESHOLD = 2 # ####################################################################### -- Douglas E Knapp Amazon Gift Cards; let them choose!! <a href="http://www.amazon.com/gp/product/B001078FFE?ie=UTF8&tag=seattlebujinkand&linkCode=as2&camp=1789&creative=9325&creativeASIN=B001078FFE">http://www.amazon.com/gp/product/B001078FFE?ie=UTF8&tag=seattlebujinkand&linkCode=as2&camp=1789&creative=9325&creativeASIN=B001078FFE</a>