[mtekman]

I have a utility that parses ssh failed attempts and creates iptables blocklists:

https://gitlab.com/mtekman/iptables-autobanner

For those just wanting the blocklist, here is a table of malicious IP addresses, with columns of: address, number of ports tried, number of usernames tried.

https://upaste.de/bgC

[securethrowaway]

I simply run fail2ban with a whole bunch of customer filters that will ban people very quickly. There's no need to request php or malformed urls when php is not used for example.

[mtekman]

I used to run fail2ban, but I found it (or at least its defaults) ineffective against discouraging further requests. With iptables, you can specify the connection to hang for a period and then drop

[justsomehnguy]

Defaults are set to reject. Just configure the jails or a global config.

[miah_]

A iptables hashlimit rule can do the same. Your firewall rules get to be more readable and you don't end up relying on the security of a log parser.

The biggest win comes from just disabling password authentication in sshd though.

[Phelinofist]

I run endlessh, I always giggle when I see some connection that last for 2d

[sambazi]

a lot of ppl thought this would be a good idea at some point

[eps]

upaste link is 404