Re: Compromised Linux box stories (Re: [SLUG] upgrading complicated installs

[Dean Hamstead <dean@xxxxxxxxxxxxxxx>]

> I am running a server that was getting heaps of password cracking
> attempts on SSH port 22. Since changing the port, the attempts
> have stopped.

Denyhosts is a great daemon/cronscript that will manage hosts.allow for 
your ssh server. you can set thresholds and instant triggers etc which 
will result in that ip being blocked.

Also, you could turn off password auth and just use keys.

Dean
--
http://fragfest.com.au