ssh brute force attacks 3212

Peter T. Breuer them is red

Ayup. As usual, dear Peter, while I truly respect and admire your intelligence and knowledge, your personality could use a long session with an industrial sander. It seldom fails that you turn abusive when someone is struggling to understand you, does it?

Oh, well, that's just the way you are, and your contributions are worth it.. I'd rather have them without the abuse, but better that than not at all.

And that's the question. What if they spoof what IP? My public ? The script isn't that dumb. An internal private ip? Neither my router or my machine are dumb enough to accept a packet on an interface it shouldn't have come from. Someone else's public IP? Yes, as noted, I'll be temporarily denying that innocent person. That's not "against yourself", though, but if that's what he meant, great.

But that can't be the case for someone who has failed login attempts, which is where this all started; if you are spoofing an ip, you aren't ever going to know whether I ever responded to your login atttempt at all!

So the only case where this makes any sense at all would be that xyz tries to login to my machine, fails, attempts the magic number of times in the magic time period, and gets locked out. Noticing this, he decides to take revenge and starts a DOS attack with multiple spoofed IP addresses.

I find that scenario more than extremely unlikely.

they and It's machine, login!

Cripes! The THREAD is about ssh brute force login attacks. Those are the ip's we're talking about locking out.

And as I've said multiple times, why do you buttume that a lock-out script is dumb enough to lock an IP you know you need to use? Or that it can't reset these after pbuttage of a certain amount of time? Or that it remains in place forever?

I don't know. Perhaps that you keep ignoring what I ask and then set up straw men to knock down with great derision? Does that feed something inside you?

As I've said more than once, if someone has the desire to DOS me, they are going to do so. I do not accept that blocking ip's of apparent break in attempts in any way "is a nice way introducing DOS attacks against yourself". Neither you ar anyone else has said anything that adequately defends that position.

-- Tony Lawrence