> Is there a way to only allow one ksh attempt per IP per timeframe. > And after X attempts to block it for an hour or so? It also helps to run SSH on a non-standard port. Not really any more secure, but it cuts the noise level down a lot.