Large scale Internet SSH brute force attacks seem to have stopped here

Re:Large scale Internet SSH brute force attacks seem to have... by klausagnoletti on Tuesday August 30, 2022 @06:30AM (#32648680)

As someone else mentions, CrowdSec can do just that. It's FOSS and can act as a modern Fail2Ban replacement that can detect all sorts of attacks - in this case ssh bruteforce/slow brute force attacks - and shares very basic information about those attacks (source ip, timestamp, which attack) with everyone else. So in that way everybody using CrowdSec are helping each other out. More information at https://crowdsec.net. Disclaimer: I am head of community at CrowdSec so feel free to ask me any questions you may have here or join our Discord at https://dicord.gg/crowdsec.

[ Parent | on HN ]

Re:Large scale Internet SSH brute force attacks seem to have... by gingerlime on Tuesday August 30, 2022 @01:50PM (#32653090)

Thank you! super cool! how do you solve the trust issue? (e.g. someone reporting their competitor ips as attackers, or whitelisting false positives/appeals)

[ Parent | on HN ]