network/sshblock/README



SSHblock is intended to dynamically and automatically stop SSH-based
dictionary attacks by blocking any IP address that fails an SSH
login too many times too quickly, and automatically unblocks it
after a while.

You may change the pre-defined configuration of SSHblock in
sshblock.pl.tpl (whitelist IP, email, and hostname).

NOTE:
You may need to add this in /etc/rc.d/rc.local after giving
execute permission on /etc/rc.d/rc.sshblock

# Start sshblock
if [ -x /etc/rc.d/rc.sshblock ]; then
  /etc/rc.d/rc.sshblock start
fi