[thelist] SSH login attacks

[Chris Marsh]

Justin

> I have been reading my server mails and have noticed that I 
> am getting 
> SSH script kiddie attacks, where I get up to 5000 attempted 
> SSH logins 
> from mostly the same domain (ie the same domain attacks one day, and 
> then it is another domain the next day).

Why don't you block by country? Attempts were reduced by 60% by blocking
Taiwan, China and Korea according to someone on another list who was
experiencing a similar inconvenience. Performing some analysis should yield
other countries to block, also. It depends on your business of course, but
if you don't supply products or services to that part of the world why
listen to packets originating there? 

[..]

Regards

Chris Marsh

_______________________________________________________________________
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender and delete the email immediately. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. 

Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company.

Finally, the recipient should check this email and any attachments for the presence of viruses. Callserve Communications accepts no liability for any damage caused by any virus transmitted by this email. _______________________________________________________________________
This email has been scanned for all viruses by the MessageLabs SkyScan
service.