I recently discovered that not all of the iptables extension modules are documented in the iptables manualpage, at least the versions installed on Debian Sarge or Fedora Core4; they're only documented in the netfilter.org extensions HOWTO here ,or sometimes not even there.

I care about this because this means there's interesting things I coulddo with iptables that I can't find out by reading the manpage. So for myfuture reference and anyone else's use, here's a quick summary of

I recently stumbled over this blog entry on a nice, easy way to stop brute force ssh scans, so it's time tospread this knowledge around.

If you've got an ssh daemon exposed to the Internet, you know aboutthe brute force ssh scans and password guessing attacks. The realproblem with them is the sheer volume, which creates log clutter (andsystem load) as they spew login failures and unknown users all overyour logs.

(If brute force ssh attacks give you security ulcers,