Siliencing ssh probers

mrquietIts been quiet recently for fail2ban (my blog) on ssh.  People cannot get a protocol.

Yes they still connect like 108.45.93.68 did below and based in the us but with nothing in common so failtoban has little to do.

sshd[x]: Connection closed by 108.45.93.68 [preauth]
sshd[x]: fatal: Unable to negotiate a key exchange method

Its not hard to do if you want it as well it uses protocol 2 selectively for a hint.

Find them in logs with

grep "Connection closed" /var/log/auth.log | awk '{ print $9 }' | sort -n | uniq -c

by golly but...

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s