SSHD Feature Request

[Damien Miller]

Seann Herdejurgen wrote:
> With the increased number of "brute force" login attempts against
> port 22, I am concerned that an intruder may actually stumble accross
> a valid user/pass combination.  To combat this, I would like to
> request an sshd_config option that would cause the running sshd
> parent process to keep track of login failures by IP address.  If
> there are more than X number of login failures for a particular IP
> address over a fixed period of time, simply deny login to all
> attempts after the first X tries.

We are pretty sure that we don't want to do this for a variety of
reasons. But, that doesn't stop you from doing it with a little
perl script that watches syslog and pokes addresses into your packet
filter of choice.

This has been discussed on the list a couple of times, pleast check the
archives for more detailled comments.

I have some other ideas on how to mitigate these attacks in sshd,
hopefully I'll have time to implement them soon.

-d