[Lvlug] Re: Finally, someone's trying to hack in. :-)

[Faber Fedor]

On 20/12/05 22:07 -0500, Stuart Boreen wrote:
> I remember reading about a script/program that looks for 3 
> failed attempts at ssh login, then blocks that ip with 
> iptables -- or something like that.
> Anyone on the list see this in Linuxjournal?

I now what you're talking about; I just can't remember the name.  It
works on any port; it looks for X number of connections on a port from a
specific IP address and then closes that port for that IP address.

The only name that comes to mind is "portknocker" and I know that's not
it.

Let me sleep on it.

OTOH, this fits your description albeit manually: 
http://www.debian-administration.org/articles/187

-- 
 
Regards,
 
Faber Fedor
President
Linux New Jersey, Inc.
908-320-0357
800-706-0701

http://www.linuxnj.com