OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: avoid logging useless ssh brute force attempts

From: elpinguim (elpinguimgmail.com)
Date: Fri Feb 01 2008 - 06:43:20 CST


On Fri, Feb 01, 2008 at 06:11:17PM +1100, Chris wrote:
> my logs are filled with useless ssh bruteforce attempts - is there
> anything i can do to avoid logging random brute force attacks? since i
> disallow ssh root login and use the allowuser acl - i guess i could
> just avoid logging all these random attacks in my logs.
>
> Any suggestions would be much appreciated. Thanks.

Configuring pf to not even respond to unallocated ip space also
helps. Search for Bogon filtering.

BruteForceBlocker works great:
http://danger.rulez.sk/projects/bruteforceblocker/

Kind regards.

--
i am jack's annoying signature.