|
LYb
|
 |
« Odgovor #2 poslato: 01 Фебруар 2006, 03:51:53 » |
|
Mmm, da, samo mi je uvek nekako bilo "mnogo posla", iako ga nema puno. Ovo radi na zgodnu foru, ako ne pokusa login na postojeceg usera, blokira IP, ako user postoji i pogresi password unapred definisani broj puta, blokira ga. Blokira ga tako sto ga doda u predefinisani SSHD chain u uptables gde dropuje sve sa tog IP-a sto dolazi na port 22. Evo primera sa sajta koji najbolje ilustruje kako to izgleda u praksi:
With sshdfilter installed, taking each attack on a case by case basis:
347 attempts becomes 0 attempts - first attemped guess was for a non-existant user, so was instantly blocked.
306 attempts becomes 0 attempts - same reason, non-existant user.
115 attempts becomes 1 attempt - first guess was for root and is allowed a default of 3 chances, the second guess was for a non-existant user and so was blocked anyway.
115 attempts becomes 1 attempt - same as previous.
127 attempts becomes 3 attempts - many initial guesses for root account, so sshdfilter blocks after the first 3 failed attempts.
18 attempts becomes 0 attempts - first attempted guess was for a non-existant user, so was blocked instantly.
554 attempts becomes 3 attempts - many initial guesses for root accont, so sshdfilter blocks after the first 3 failed attempts.
107 attempts becomes 1 attempt - first guess was for a valid user (nobody), second guess was for a non-existant user so was blocked.
9 attempts becomes 0 attempts - first guess was for a non-existant user so was blocked instantly.
52 attempts becomes 3 attempts - many initial guesses for root accont, so sshdfilter blocks after the first 3 failed attempts.
|
