[CentOS] [WTA] Automatically blocking on failed login

On Mon, 2010-05-24 at 23:55 +0700, David Suhendrik wrote:

> Hello All,
> I had problems with the security server, the server is frequently
> attacked using bruteforce attacks. Is there an application that can
> perform automatic blocking when there are failed login to the ports
> smtp, pop3 port, and others?
> 
> I am currently using CentOS 5.5 in some servers
> Thanks in advanced.......
> 
> -- 
> --
> Best regards,
> David
> http://blog.pnyet.web.id
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos


If you want an complete IDS then you could go for OSSEC
(http://www.ossec.net/). You can configure it to scan whatever log file
you like and block the ip that generate an error message in that log
file. While it could be a little overhead to tweak, it can achieve
remarkable results.


Calin

Key fingerprint = 37B8 0DA5 9B2A 8554 FB2B 4145 5DC1 15DD A3EF E857

=================================================
The climate of Bombay is such that its inhabitants have to live
elsewhere.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.centos.org/pipermail/centos/attachments/20100524/c3bc4463/attachment-0001.html>