Brute force attack from different IP's

[arjena]

Hi,

I get brute force attack warnings because more than 100 attempts are made to log in as root (ssh).
I have CSF installed, but the problem here is that the attacks do not come from one IP address but 'they' use one IP number for 3 to 6 tries, then the same thing happens from the next IP. Therefore I cannot block by IP.
Is there any other way to fend off this attack? Or do I just have to sit it out and wait for 'them' to move on to the next victim?

Cheers,

Arjen

 

[scsi]

Move ssh off the standard port and you wont have a problem with it.

 

[Arieh]

Personally I have port 22 not in the list of open ports in CSF. Instead I allow my own IP addresses to have access through the firewall, so I can login myself. You don't really need to worry about if your IP would change, as you can still access directadmin to change CSF.