Another program, similar to Fail2Ban, is DenyHosts [1]. The difference is that DenyHosts can also sync with other DenyHosts to automatically add the IPs of attackers to hosts.deny. After a few months of using it, I have almost 14,000 lines in my hosts.deny (!). It's highly configurable. I went that route because I was using Fail2Ban and found the delay to be too great (it monitors /var/log/messages or auth.log, I guess). By the time the IP gets banned, the attackers have the chance to try about 20 or so different passwords (and this is with F2B set to deny after 2 failed attempts). Looking at the F2B manual, it seems this is due to the buffering of the syslogs.The thing that seems to work the best, although it currently isn't an option for me, is to use a non-default, port. <br>
<br>HTH,<br>-Steve Brown<br><br><br>[1] <a href="http://denyhosts.sourceforge.net/features.html">http://denyhosts.sourceforge.net/features.html</a><br>