A useful tool for detecting and blocking SSH login attacks, which also shares data in a centralised DB so you can pre-emptively block IPs that have attacked other systems: http://denyhosts.sourceforge.net/

Also, a source of stats that may be helpful in analysing probabilities of success: the Linux counter has stats on numbers of user accounts per machine (http://counter.li.org/reports/machines.php).

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/infocus/1876/695#695