
login_sentry updated to v2.2
Thursday, February 2nd, 2006
A couple of users informed me of some minor bugs (thanks!), so I’m releasing a small update to fix them. Some of the pattern matching was also improved to handle log lines from a wider variety of ssh versions and authentication methods.
It can be retrieved here: http://www.lumiere.net/~j/login_sentry/
For those unfamiliar with login_sentry, it’s a small perl daemon that watches a system logfile for bad login attempts and temporarily bans hosts (via tcpwrappers / hosts.deny) that fail to authenticate repeatedly. This prevents those annoying brute force ssh attempts from filling up your logfile. Additionally it can also watch for authentication attempts via a few other services (postfix SASL, dovecot, and pwauth).
I use it to prevent brute force login attempts via all my authentication methods (including via webmail) and also ban access to all authenticated services (again, including webmail). Since it doesn’t require anything besides a standard perl install (no special libraries) and bans via hosts.deny instead of firewall rules, it’s fairly portable too.
A couple of users informed me of some minor bugs (thanks!), so I’m releasing a small update to fix them. Some of the pattern matching was also improved to handle log lines from a wider variety of ssh versions and authentication methods.
It can be retrieved here: http://www.lumiere.net/~j/login_sentry/
For those unfamiliar with login_sentry, it’s a small perl daemon that watches a system logfile for bad login attempts and temporarily bans hosts (via tcpwrappers / hosts.deny) that fail to authenticate repeatedly. This prevents those annoying brute force ssh attempts from filling up your logfile. Additionally it can also watch for authentication attempts via a few other services (postfix SASL, dovecot, and pwauth).
I use it to prevent brute force login attempts via all my authentication methods (including via webmail) and also ban access to all authenticated services (again, including webmail). Since it doesn’t require anything besides a standard perl install (no special libraries) and bans via hosts.deny instead of firewall rules, it’s fairly portable too.
