| |||||||||||||
Unrelated IP addressesUnrelated IP addressesPosted Oct 26, 2009 19:35 UTC (Mon) by NAR (subscriber, #1313)In reply to: Unrelated IP addresses by ikm Parent article: Distributed brute force ssh attacks
But after the third try, the user will be locked out for 2 minutes, so the next 33 tries will be in vain, even if the attacker would guess the right password...
(Log in to post comments)
Unrelated IP addresses Posted Oct 26, 2009 19:45 UTC (Mon) by ikm (subscriber, #493) [Link]
That does make sense. Though you'd have to combine it with IP-based banning too. Otherwise it'd be really easy to DoS a specific person one happens to dislike, and also bots tend to try many different user names, not just one over and over again.
Unrelated IP addresses Posted Oct 26, 2009 22:26 UTC (Mon) by dlang (✭ supporter ✭, #313) [Link]
but the attacking IP address doesn't try again for 60 min, so it's not affected by your block.
unless you say you are locking the _user_ out from any IP address for 2 min.
if that's the case an attacker will just DOS you so that you can't login to the box yourself.
|
|||||||||||||