ACZoom

Hi,

I like your answer to the ssh scanning attacks.

However, could I ask that you add a whitelisting feature?
For instance, as is added to this product: http://www.pettingers.org/code/sshblack.html#regex

The problem is that attackers could spoof the source IP address of ssh logon attempts to come from your own network, locking yourself out of your machine. This effectively is a Denial of Service, as your are unable to then connect to your own machine (it denies you service).

The simplest avoidance measure would be for BlockHosts to add a whitelisting feature, which prevented matching regexs from being blocked. This would mean that you could always guarentee to be able to connect to the server from that IP address.

Regards

Craig Macdonald