blacklist hosts after 3 wrong password

You can achieve roughly the same thing already using the "fail2ban" package, which adds temporary iptables rules when it sees enough failed attempts on ssh (and other services).

Thank you, I didn't know about the fail2ban package. Maybe i'll try it (i wonder if it works immediately after install, or needs manual configuration to enable it?).

anyway, if it works it's true that it could be good enough to have an external package (as is the case now) to do that, since ssh-server is not installed by default and since only more expert users install ssh.

You might also investigate using public and private key authentication and turning off password authentication. This would reduce the possibility of brute force attacks. You can learn more about key authentication here: https://help.ubuntu.com/community/AdvancedOpenSSH#head-f06532af79917a251e68c7ccf567cb5c399e0aba

I am running Ubuntu server edition and was surprised to see so many attacks on my /var/log/auth.log*

# zcat /var/log/auth.log.* | grep Failed | less

I think if Ubuntu wants to push the server to the next level it must ensure security, reliability and speed. Is there a reason why and IP blocker tool is not integrated with the sshd daemon?

Should I open a feature request and propose this on Feisty+1 or do you think that this is something that the sysadmin should configure him/herself if needed?

We could use the fail2ban tool suggested above but these are other tools that seem to do a similar job. Unfortunately we do not have packages for any of them:

sshguard:
http://sshguard.sourceforge.net/
http://www.linux.com/article.pl?sid=07/02/27/1957242

BlockSSHD:
http://blocksshd.sourceforge.net/

sshdfilter:
http://www.csc.liv.ac.uk/~greg/sshdfilter/

Using a crappy password for an important service because it needs to be easy to remember is a very, very bad idea. A much better idea is to choose a difficult-to-crack password, and keep it in your wallet.

While it takes some setting up, as long as you're keeping things in your wallet you might look into setting up OPIE (S/KEY) for your server. It uses a short pass phrase, that changes every time you log in. Practically impossible to crack, and renders keyboard sniffing useless.

Many sshd users, because of the constant crack attempts (my logs are filled, too), opt to choose a different port for their servers to sit on. This pretty much eliminates the attacks.

Personally, I use key-based authentication, with a failover to OTP. I keep a list of the passphrases in my wallet.

The functionality to do this is in pam_tally. I am changing the package to pam, as this is not openssh specific.