sshd password-guessing attacks

[Tom Yates <madlists@xxxxxxxxxxxx>]

i'm seeing a lot of sshd password-guessing attacks in my logfiles.  it's 
been ramping up over the past few months, but it's now getting seriously 
frequent.

i've already got sshd tied down, inasmuch as users have to be a member of 
a particular group to ssh in, and i'm about to start running a 
password-guessing tool.  but sshd is very useful to me, and i'm not 
prepared to shut it down or limit its accessibility.

what i want is a way to limit the number of new connections any one IP 
address can make, particularly if it starts issuing an awful lot of bad 
passwords.  an iptables-based solution would be fine, as would an 
sshd-based solution, but i'll entertain anything that works.

does anyone else have this problem, and if so, what are people doing about 
it? reply offlist, please, and i'll summarise later this week.


--

  Tom Yates
  Cambridge, UK.
_______________________________________________
LinuxManagers mailing list - http://www.linuxmanagers.org
submissions: LinuxManagers@xxxxxxxxxxxxxxxxx
subscribe/unsubscribe: http://www.linuxmanagers.org/mailman/listinfo/linuxmanagers