i'm interested in software or set of scripts to keep a lists of filtered IP that attempt to brute-force ssh, and to label an IP as brute-forcing i would add some checks like:
- one attempt to log as root is a ban
- three attempts to log as a nonexistent user in a day is a ban
- a port scan is a ban (this i know there are tools for this like psad)
i'm wondering if there is a tool that allows this, also, you think its feasible to keep such an ever growing lists or there are better approaches for this?
Given the levels of brute-force ssh traffic i get, i'm tempted to filter everything by default and whitelist specific client ips (i don't host web so it is an option) but i would like to hear other approaches for this matter