Brute-force login attack

[bealzz]

I'm getting the following on one of my Linux servers;

Oct 30 11:49:52 nmc sshd[5628]: User root not allowed because not listed in AllowUsers
Oct 30 11:49:53 nmc sshd[5710]: reverse mapping checking getaddrinfo for server1.goldcities.net failed - POSSIBLE BREAKIN ATTEMPT!
Oct 30 11:49:53 nmc sshd[5710]: User root not allowed because not listed in AllowUsers
Oct 30 11:49:53 nmc sshd[5834]: reverse mapping checking getaddrinfo for server1.goldcities.net failed - POSSIBLE BREAKIN ATTEMPT!
Oct 30 11:49:53 nmc sshd[5834]: User root not allowed because not listed in AllowUsers
Oct 30 11:49:54 nmc sshd[5886]: reverse mapping checking getaddrinfo for server1.goldcities.net failed - POSSIBLE BREAKIN ATTEMPT!
Oct 30 11:49:54 nmc sshd[5886]: User root not allowed because not listed in AllowUsers
Oct 30 11:49:55 nmc sshd[5914]: reverse mapping checking getaddrinfo for server1.goldcities.net failed - POSSIBLE BREAKIN ATTEMPT!
Oct 30 11:49:55 nmc sshd[5914]: User root not allowed because not listed in AllowUsers
Oct 30 11:49:56 nmc sshd[5939]: reverse mapping checking getaddrinfo for server1.goldcities.net failed - POSSIBLE BREAKIN ATTEMPT!
Oct 30 11:49:56 nmc sshd[5939]: User root not allowed because not listed in AllowUsers

I've cut out about 20 pages but its still going. I want to block whoever is doing this, but because its a fake reverse map I can't figure out this guy's IP address to block it. Anyone have any ideas?

I did the following line on my IPTABLES;
iptables -I INPUT -p tcp --dport 22 -i eth0 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -
j DROP

But it didnt seem to do anything. Thanks!!

 

[Xipher]

you might look at

netstat -ntp | grep sshd

might give you some help

Another option is to edit your sshd_config to use

UseDNS no