Re: ssh scans

["Cyrille Vladimirov" <kiro%kircho.net@localhost>]

Another one solution, just change default port 22 of ssh server to
something else, for example 4546. This will ignore lot of bots and
attacks.
Cyrille

On 10/26/2009, "David Wetzel" <dave%turbocat.de@localhost> wrote:

>Hi,
>
>I am seeing a lot of ssh scans and I am wondering if somebody has a
>solution like adding the bad hosts temporary to pf.conf or so?
>
>
>see for yourself:
>
>cat /var/log/authlog | grep -i failed | grep user | sed "s/.*from\ //
>g" | sed "s/ port .*//g" | sort | uniq -c
>
>David
>