sshdfilter

wget http://www.csc.liv.ac.uk/~greg/sshdfilter-1.5.3.tar.gz
tar -zvxf sshdfilter-1.5.3.tar.gz
cd sshdfilter-1.5.3/source
chmod a+x sshdfilter.pl
mv sshdfilter.pl /usr/local/sbin

/etc/syslog.conf-ba:
auth,authpriv.* |/var/log/sshd.fifo

mkfifo /var/log/sshd.fifo
/etc/init.d/syslogd restart
cd ../etc

sshdfilterrc-ben debian etch-hez ezeket kell átírni (diff szerűen :):
-logsource='STDIN'
+logsource='/var/log/sshd.fifo'

-#+'^192\.168\.0\.[0-9]+$' # always accept, never block LAN connections
++'^192\.168\.1\.[0-9]+$' # always accept, never block LAN connections
++'^127.0.0.1$'

és még ezeket belerakni a végére:
msg_invalid='^Invalid user (.*) from ([0-9a-fA-F:\.]+)'
map_invalid='push @res,$1; push @res,$2;'
msg_invalid='^Failed .* for invalid user (.*) from ([0-9a-fA-F:\.]+) port [0-9]+
ssh2'
map_invalid='push @res,$1; push @res,$2;'
msg_failed_valid='^error: PAM: Authentication failure for (.*) from ([0-9a-fA-F:
\.]+)'
map_failed_valid='push @res,$1; push @res,$2;'
msg_failed_valid='^Postponed .* for (.*) from ([0-9a-fA-F:\.]+) port [0-9]+ ssh2
'
map_failed_valid='push @res,$1; push @res,$2;'
msg_no_id_string='^Did not receive identification string from ([0-9a-fA-F:\.]+)'
map_no_id_string='push @res,$1;'
msg_quit='^Received signal ([0-9]+); terminating.'
map_quit='push @res,$1;'

mv sshdfilterrc /etc

a /etc/rc.local-ba:
iptables -N SSHD
iptables -I INPUT -p tcp -m tcp -s ! 192.168.1.0/255.255.255.0 --dport 22 -j SSHD
/usr/local/sbin/sshdfilter.pl

ha nem akarjuk megvárni az újraindítást a cucc elindításával:
/usr/local/sbin/sshdfilter.pl

valamint a log vizslatása, hogy talált -e valami hibát:
cat /var/log/auth.log | grep ssh | less