# block known linux service user accounts ssh attemptsįor badip in `awk '/sshd/ & /Failed password for /' /var/log/auth.log | egrep -i 'root|bin|daemon|adm|lp|sync|shutdown|halt|mail|news|uucp|operator|games|rpm|vcsa|rpc|xfs|apache|rpcuser|sshd|ftp|kamphor|named|messagebus|haldaemon|ntp|openvpn|x11|polkituser|avahi|avahi-autoipd|htdig|pulse' | awk '' | tail -2` # script to sense bad ssh or ftp login tries from the same ip address I have the following script running as a background job initiated from /etc/rc.local hope this is helpful to people.

Guess it's time to give back to the community.a few years ago, I wrote a custom script to continually tail out lines at a time from /var/log/auth.log and null route the bad ip's.to date, I have 4316 ip's null routed.

That would be like retrofitting a tricycle to make it supersonic. I could be wrong, but since ftp is inherently insecure, I would be surprised if someone had created software with the same functionality as denyhosts that would work with ftp. But ftp sends passwords in cleartext, so it actually does pose a risk to you if someone is able to sniff your packets on the public internet.īut anyway, if you feel that the risk to you is insignificant, then why are you asking the question? Are you asking it on behalf of other people who might want to security-harden their ftp servers? If those people are worried, why wouldn't they have already switched from ftp to sftp? And if they're running sftp, they can protect against attacks of the type you're describing by installing denyhosts: Denyhosts does have a cooperative blacklisting facility of the type you were asking about. You say this poses no real risk to you, because your passwords are immune to dictionary attacks.

How to hack ftp cyberduck