[PLUG] automatic firewall rules adder?

[Jon Scully]

On 6/12/06, Brent Rieck <bsr at spek.org> wrote:
>
> Hello,
>    I seem recall somebody here mentioning a program that would scan your
> log files for failed login attempts via ssh and then add those IP
> addresses to your firewall rules.  Was I dreaming?  Or does such a
> program already exists?
>
> thanks,
> Brent


Blocking can create quite a large list, over time.  Moving the ssh port or
using port-knocking might lighten the load on your system.  Here's more
information and example <http://jonscully.googlepages.com/>.