Re: [gentoo-user] Why isn't sshd blocking repeated failed login attempts?

[Etaoin Shrdlu]

On Tuesday 20 January 2009, 22:33, Paul Hartman wrote:
> Hi,
>
> After setting up public key authentication i changed my sshd back to
> port 22 and got the expected bombardment of connection attempts.
> However, it doesn't seem to ever stop them. I'm using sshd with this
> setting:
>
> MaxAuthTries 3
>
> in my /etc/ssh/sshd_config
>
> So, why does it allow unlimited failed login attempts? For example, as
> I write this I'm seeing this in my logs:
>
> Jan 20 14:54:38 [sshd] Invalid user ejin from 72.70.42.36
> Jan 20 14:54:39 [sshd] Invalid user core from 72.70.42.36
> [cut]

What MaxAuthTries does is just start logging the failed attempts when 
they reach ( value / 2 ).

MaxAuthTries
             Specifies the maximum number of authentication attempts
             permitted per connection. Once the number of failures
             reaches half this value, additional failures are logged.
             The default is 6.