search for: sshblack

...program to listen to the AMI and create a > > rule in iptables for ip in specific. > > > > Does anyone have any suggestions? > > > > > > Thanks, > > Rodrigo Lang. > > > Does asterisk log the failed attempts to a file? > If so then you could use sshblack to monitor the file for incorrect > logins. It will add firewalls rules to a custom iptables chain based on > various criteria. You can then point incoming SIP connections through > this chain so offenders will be forewalled for a specific amount of time. > http://www.pettingers.org/cod...

Has anyone implemented a script to block IPs which are attacking on POP3 ports using dovecot logs to indicate repetitive failed login attempts? sshblack does this nicely for ssh (port 22) attacks by monitoring the /var/log/secure file. I am considering rewriting this to POP3 port (110), but if it has already been done, I sure don't need the practice. Thanks!

Hello list. I'm trying to find a way to block any ip that tries to login more than three times with the wrong password and try to log in three different extensions. For I have suffered some brute force attacks on my asterisk in the morning period. The idea would be: Any ip with three attempts without success to log into an extension is blocked. Is there any way to accomplish this directly