Fail2Ban automatically adds a iptables rule to block all traffic from the atacking address, and then sends off an e-mail informing you - so it does do that<br><br><div class="gmail_quote">2010/1/27 Jason A. Nunnelley <span dir="ltr"><<a href="mailto:jason@jasonn.com">jason@jasonn.com</a>></span><br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="im">On Wed, Jan 27, 2010 at 1:03 PM, Domenic Santangelo <<a href="mailto:domenics@gmail.com" target="_blank">domenics@gmail.com</a>> wrote:<br>
> I'm hearing some complicated attack vectors being tossed around in here (password sniffing, mitm, etc) -- don't forget about a pretty simple one: dictionary attacks. I recently took over a project for a small-medium sized client and upon looking at the secure log noticed 50k+/day dictionary attacks against SSH. I installed fail2ban and now get 5-6 emails daily about brute-force hack attempts.<br>
<br></div>Just wonder why you don't simply block attempts beyond 5 or 10.<div><div></div><div class="h5"><br><br>-- <br><br>Jason A. Nunnelley<br>----------------------------------------<br><a href="http://www.jasonn.com" target="_blank">http://www.jasonn.com</a><br>
<a href="http://www.tekany.com" target="_blank">http://www.tekany.com</a><br>
+1 256 297 1652<br><br>
</div></div></blockquote></div><br>