Par exemple quand on a ce genre de log:

Apr 21 12:16:18 Unimonde sshd[3096]: Invalid user teamspeak from 60.217.229.228
Apr 21 12:16:18 Unimonde sshd[3096]: pam_unix(sshd:auth): check pass; user unknown
Apr 21 12:16:18 Unimonde sshd[3096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.217.229.228
Apr 21 12:16:20 Unimonde sshd[3096]: Failed password for invalid user teamspeak from 60.217.229.228 port 47711 ssh2
Apr 21 12:16:24 Unimonde sshd[3098]: Invalid user teamspeak from 60.217.229.228
Apr 21 12:16:24 Unimonde sshd[3098]: pam_unix(sshd:auth): check pass; user unknown
Apr 21 12:16:24 Unimonde sshd[3098]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=60.217.229.228
Apr 21 12:16:26 Unimonde sshd[3098]: Failed password for invalid user teamspeak from 60.217.229.228 port 48867 ssh2
Apr 21 12:16:30 Unimonde sshd[3100]: Invalid user teamspeak from 60.217.229.228



C'est qu'on a un rigolo qui tente de se connecter… ou en tout cas un bot!

Dans ce cas il existe des softs qui banissent les IP qui tentent de se connecter trop de fois.

2 programmes font ça:

Denyhosts : http://doc.ubuntu-fr.org/denyhosts

Fail2ban: http://doc.ubuntu-fr.org/fail2ban

Avec la configuration adequat ça filtre très bien!