I would like to see the ssh deamon stop allowing attempts to connect from an ip address after a certain number of failures. My logs tend to fill up after a night of script kiddy hell. 1) There should be a way to turn this off/on 2) A way to get the list and re-enable/remove an ip address. 3) A attempt count setting so that after X failures autoblocking happens I've grown very accustomed to something similar on AS400's. It very hanndy to have. thanx, -jj-
We won't implement reflexive blocking, it can be easily implemented by scanning logs (i.e not in ssh) and there are too many ways it can be turned into a denial-of-service. If you really want to do this, there are scripts that will parse logfiles and add addresses found to a firewall rule.
I'll also add that if you really want this and your sshd is built with PAM then then you could implement this policy in a PAM module (eg hack pam_tally to take notice of PAM_RHOST).
Incidentally, if folks running PAM really want to do this, there's now a pam_abl module that does it: http://www.hexten.net/sw/pam_abl/
Change all RESOLVED bug to CLOSED with the exception of the ones fixed post-4.4.