Re: [gentoo-user] [OT] Blocking only unsuccessful ssh connections

[José González Gómez]

Hi there

2006/10/5, Daniel da Veiga <danieldaveiga@×××××.com>:
>
> On 10/5/06, José González Gómez <jgonzalez.openinput@×××××.com> wrote:
> > Hi there,
> >
> > I've got a virtual private server hosted somewhere and they're blocking
> me
> > because their intrusion detection system detects 10 ssh connections in
> less
> > than 2 minutes from my current IP. My question is: is it possible for an
> > intrusion detection system to differentiate between successful and
> > unsuccessful ssh connections so they don't block me? Of course all my
> > connections are successful.
> >
>
> As Hans-Werner already told you, there are better ways to detect
> intrusion, and of course they could implement it in a way successful
> connection would not cause the intrusion detect system to block you,
> but its a bit more complicated and would involve the whole system,
> wich most providers do not want/care to have and if they have, they
> charge over it.
>
> The questions here, if you don't want to argue with your host
> provider, would be:
> 1) Is there another provider that does not have such limitation?


Well, I would really know about this... does anybody know?

2) 10 connection in 2 minutes is a good config, why do you have so
> many connections in so little time? Is there another way to do
> whatever you're trying to do with less connections?


Unfortunately I'm not "responsible" for making these connections. I'm using
Maven (http://maven.apache.org/) to deploy some files to my server. Maven
seems to use a different ssh connection for every operation it does (check
for current version deployed, read metadata, copy several files to remote
server...). I'll write to the Maven list to ask about this, maybe there is
some way to slow down or reuse connections.

I've rewrote a complete system just so I would not have to discuss my
> ISP security policies. I guess it was faster to change a few hundred
> lines of code than to keep calling them on the phone to argue about it
> (if I could, I would have changed ISP).
>
>
Well, that's another option. After all Maven is open source, so I could take
a look at the code making the connections and try to improve it.

Thanks a lot, best regards
Jose