Re: How to auto-ban access form certain IP addresses?

Matt Giwer wrote:
dnoyeB wrote:

I run an RH9 box and someone is constantly trying to break in over the last year. Its not remotely accessible in they way they are trying so I am not concerned. However, I wish I would shut down access from a certain ip address after so many attempts, and send an email to myself. As opposed to watching 1000s of entries in my log each day from the same address.

Is there a manual way to do this? I assume by editing config files for telnet,ssh, etc. Is there an automatic way to do this?


I'll give you a better way. Whois the ip and give them a voice call or email with the date and time of that attack. Don't just block it. Get the boy kicked off line.


Its a good idea but typically these come from Asia and the numbers change about twice a month. I've written over spam as well as attacks and never met a person that gave a ***, even when they have an abuse address associated with the IP block...

--
Thank you,



"Then said I, Wisdom [is] better than strength: nevertheless the poor man's wisdom [is] despised, and his words are not heard." Ecclesiastes 9:16
.

Quantcast