steve wrote: > Hi there, > > Since February 11th at 00:25:09, I am getting the following every 12 > secondes: > > Feb 11 00:25:09 box sshd[17733]: Connection closed by 118.126.105.120 port > 54422 [preauth] > > And when I say every 12 seconds, it is really every 12 seconds, and this > is now going on for more than 13 days, without any interruption. At the > beginning, I thought that this was just standards nmap scans or > something similar and so didn't bother taking any action. But now I'm > asking myself who (in China) would be so stupid to continue this > scanning. > > What should I do? Send an email to the abuse contact? Ignore it and wait > that it's over? It doesn't seem naughty but it's getting irritating.
sudo apt install iptables-persistent sudo iptables -A INPUT -s 118.126.105.120 -j DROP sudo netfilter-persistent save If you want rules inserted automatically and removed after a time, install fail2ban. -dsr-
