[thelist] SSH login attacks

Chris Marsh Chris.Marsh at Callserve.com
Thu May 5 06:48:45 CDT 2005


> I have been reading my server mails and have noticed that I 
> am getting 
> SSH script kiddie attacks, where I get up to 5000 attempted 
> SSH logins 
> from mostly the same domain (ie the same domain attacks one day, and 
> then it is another domain the next day).

Why don't you block by country? Attempts were reduced by 60% by blocking
Taiwan, China and Korea according to someone on another list who was
experiencing a similar inconvenience. Performing some analysis should yield
other countries to block, also. It depends on your business of course, but
if you don't supply products or services to that part of the world why
listen to packets originating there? 



Chris Marsh



This email has been scanned for all viruses by the MessageLabs SkyScan

More information about the thelist mailing list