2

I'm trying to rate limit the number of failed SSH logins on my server. It is set up not to accept any passwords, and accepts PubKeyAuth

Is there a way to rate limit the number of bad logins I get from a user? Like if I see a lot of 

Feb 12 20:58:55 sshd[...]: Failed publickey for ...

Can I do something like limit that to X attempts every Y mins? I tried using PAM, but it looks like it is used only for password based auth

user3666471
  • 131
  • 1

1 Answers1

1

Assuming UsePAM yes PAM is used even when using key-based authentication but only the account and session modules.

However, I'd suggest something like fail2ban to attain this goal.

Mark Wagner
  • 17,764
  • 2
  • 30
  • 47