IpTables Question re. SSH Attacks! Organisation: Free Agent via Linux OS and Wine Emulator
I've been reading the threads on brute force attacks. I see these and I block the addresses (after the fact) but I do monitor, log and block based on how bad the attacks were and how often I get attacked from that IP block ... but its all manual.
I would like to try the approach that on so many hits in a certain time period that that IP is logged and blocked either permenantly or for a time period (ie x hours).
Alan Connor Were's the Spam in my sig? It only shows the address of my web page. Or do you think...
I have my own firewall script that I have built up over time and I understand it so I would just like to modify it for this new use.
I have read posts and rumaged through online links but I can't seem to get a set command that does what I want.
Ie. - if any IP hits port 22 more than 4 times in 30 seconds - log the IP - block the IP for x hours
My 1 year old daughter "rebooted" a machine at home "for" me. Now NFS won't work between two machines. I have 3 machines; let's call...
For now I think I want to use the temporary block as it may be me, at a remote location, having trouble getting in from a strange network and I want to try again later.
Does someone have a link or a snippet from their firewall script that would show how to do this?
TIA! -- ------------------------------------------------ SPAM Reduction: Remove "x." from my domain. ------------------------------------------------