Nainu가 10일정도의 기간동안 LogWatch의 정보를 바탕으로 /etc/hosts.deny 에 ssh 어택을 하는 IP를 쭉 적어보았습니다. 하루에 두세개 정도씩 추가되는데 필요하신 분들이 써보시고, 개선사항이 있다면 알려주세요. 추가하실 분이 있다면 추가하셔도 좋겠네요.

#
# hosts.deny    This file describes the names of the hosts which are
#               *not* allowed to use the local INET services, as decided
#               by the '/usr/sbin/tcpd' server.
#
# The portmap line is redundant, but it is left to remind you that
# the new secure portmap uses hosts.deny and hosts.allow.  In particular
# you should know that NFS uses portmap!
#
# see also http://wiki.kldp.org/wiki.php/SshAttackList?action=show

ALL: 140.*
ALL: 61.*
ALL: 63.*
ALL: 64.*
ALL: 65.*
ALL: 66.*
ALL: 81.*
ALL: 82.*
ALL: 83.*
ALL: 84.*
ALL: 85.*
ALL: 151.*
ALL: 200.*
ALL: 201.*
ALL: 202.*
ALL: 203.81.*
ALL: 207.*
ALL: 210.196.*
ALL: 210.240.*
ALL: 210.34.*
ALL: 210.73.*
ALL: 210.77.*
ALL: 211.114.138.*
ALL: 211.124.*
ALL: 211.192.*
ALL: 211.198.*
ALL: 211.214.*
ALL: 211.233.162.*
ALL: 211.233.89.*
ALL: 211.23.*
ALL: 211.61.*
ALL: 212.202.*
ALL: 212.24.*
ALL: 213.*
ALL: 216.*
ALL: 218.249.*
ALL: 218.90.*
ALL: 220.194.*
ALL: 220.202.*
ALL: 221.12.*
ALL: 221.186.*
ALL: 221.253.*
ALL: 222.236.*
ALL: 222.236.*