<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.26.3">
</HEAD>
<BODY TEXT="#000000" BGCOLOR="#ffffff">
On Mon, 2010-05-24 at 23:55 +0700, David Suhendrik wrote:<BR>
<BLOCKQUOTE TYPE=CITE>
<TT>Hello All,</TT><BR>
<TT>I had problems with the security server, the server is frequently attacked using bruteforce attacks. Is there an application that can perform automatic blocking when there are failed login to the ports smtp, pop3 port, and others?</TT><BR>
<BR>
<TT>I am currently using CentOS 5.5 in some servers</TT><BR>
Thanks in advanced.......
<PRE>
--
--
Best regards,
David
<A HREF="http://blog.pnyet.web.id">http://blog.pnyet.web.id</A>
_______________________________________________
CentOS mailing list
<A HREF="mailto:CentOS@centos.org">CentOS@centos.org</A>
<A HREF="http://lists.centos.org/mailman/listinfo/centos">http://lists.centos.org/mailman/listinfo/centos</A>
</PRE>
</BLOCKQUOTE>
<BR>
If you want an complete IDS then you could go for OSSEC (http://www.ossec.net/). You can configure it to scan whatever log file you like and block the ip that generate an error message in that log file. While it could be a little overhead to tweak, it can achieve remarkable results.<BR>
<TABLE CELLSPACING="0" CELLPADDING="0" WIDTH="100%">
<TR>
<TD>
<BR>
<BR>
Calin<BR>
<BR>
Key fingerprint = 37B8 0DA5 9B2A 8554 FB2B 4145 5DC1 15DD A3EF E857<BR>
<BR>
=================================================<BR>
The climate of Bombay is such that its inhabitants have to live elsewhere.
</TD>
</TR>
</TABLE>
</BODY>
</HTML>