SSH Lockout 0.4.0 Released

Submitted by tensai on Sat, 01/22/2005 - 12:26am

Hot off the text editor, grab your copy of SSH Lockout now. Supplies are infinite. New features in this version include:

CIDR style addressing for whitelists
syslog logging
SYS V init script

To implement CIDR, SSH Lockout now depends on NetAddr::IP. See your local CPAN mirror for a copy.

SSH Lockout 0.4.0

3 Comments

Thanks

Submitted by Robert (not verified) on Wed, 09/28/2005 - 10:18am

Thanks for making this public - This is just what I needed.

I had to tweak it a bit (my logfile is at /var/log/secure) and add some additional patterns...examples below.

Here's what I see when I goof up my password:
sshd[9067]: Failed password for rpaxton from 207.44.202.100 port 45641 ssh2

And here is what I see (a LOT) from the script kiddies:
sshd[8502]: Illegal user amber123456789 from 205.177.72.76

Re: Thanks

Submitted by tensai on Tue, 10/11/2005 - 11:56pm

Glad I could help. I'll be releasing a new version Real Soon Now that has a number of new features, including new log parsing code that will match the two lines you posted. I've been running it on my server (*this* server, in fact) for a few months working out all the bugs.