Configure sshd to deny ip trying multiple authentication

[ergos]

Hi all,
I discovered from the logs various ip trying to ssh inside my box.

I have set up a more restrictive firewall rule but I need a way to have sshd automatically ban an ip that tries to log-in using diffrent account name or doing the authentication too many times.

Any idea how to do this?

Thanks in adavance.

 

[breun]

Take a look at Fail2Ban if you need something that's both effective and easy to setup.

 

[danliker]

take a look here:
http://denyhosts.sourceforge.net/

 

[breun]

I found out about DenyHosts before I found Fail2Ban, but I like Fail2Ban better as it creates iptables rules to block attackers instead of adding entries to /etc/hosts.deny. Either will do the job though.

 

[ergos]

Thanks to all for the answers

 

[sieb@]

APF firewall with the BFD addon. Blocks all sorts of attempts to my servers.