Siliencing ssh probers

mrquietIts been quiet recently for fail2ban (my blog) on ssh.  People cannot get a protocol.

Yes they still connect like did below and based in the us but with nothing in common so failtoban has little to do.

sshd[x]: Connection closed by [preauth]
sshd[x]: fatal: Unable to negotiate a key exchange method

Its not hard to do if you want it as well it uses protocol 2 selectively for a hint.

Find them in logs with

grep "Connection closed" /var/log/auth.log | awk '{ print $9 }' | sort -n | uniq -c

by golly but...

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.