since putting my pc online, it keeps getting slower and i dig the logfile to have such a surprise:

this is just one of a many and I beleived it's a bruteforce attack
how do i block this IP 200.41.81.228 from trying to knock my online pc?

my system:
FreeBSD testing.net 6.2-STABLE-JE FreeBSD 6.2-STABLE-JE #0: Sat Apr 21 01:07:18 UTC 2007 root@server:/usr/obj/usr/src/sys/GENERIC i386

thank you

Probably the simplest way is not to block individual IPs but to switch SSH to a higher and obscure port number, switch to an exclusive public key authentication model, and only allow explicit blocks of IP to access if possible. Blocking IPs are usually futile because these IPs most often do not represent the real cracker's IP. They just crack into many vulnerable systems and use those as shields to break in others' systems for one-time only and so the list is essentially infinite, and you will see new IPs emerge every day. They have many of these victim hosts at their disposal so if you block one they simply switch to another.

thanks! cbkihong,

i'm willing to change the sshd port
meanwhile i'm learning on IPFW and managed to get IPFW up

but while configuring the rules, I stucked at here:
this is /etc/ipfw.rules script sourced at IPFW

just a simple question:
do i need to change1. tun0 to my ethernet id
2. odns to my ISP DNS server?

let say from ifconfig, my ethernet is "bge0"
and my DNS IP is 202.188.1.1 and 202.188.2.2

thanks for advice

denyhosts might also be a useful tool.

You really should look into a neat program called "fail2ban". I have it running on a Debian-server and it's great.
You can configure how many retries someone has after a password-failure and how long they are banned (two hours in my case). It continually scans your /var/log/auth.log and acts. Check out Main Page - Fail2ban for more info.

I've looked at fail2ban a couple of times.

The one problem I can possibly see is if someone spoofed the address of a computer that you usually use to access the server.

Is it theoretically possible to create a DoS situation then? If not, let me know.

Say they keep failing using your address. Are they not effectively banning you from accessing your server.

Maybe not, just trying to verify one way or the other.

In the config-file, there is an "ignoreip" where you can exclude certain IP-addresses from being banned, you could put the admin-computer in there, I guess.