ClearFoundation

I recently was looking through my /var/log/secure for something completely unrelated and I happen to see an attempt of a ssh connection from the same IP over and over.

From what I can tell someone was trying to guess my username and password through SSH to gain access to my system. I've since blocked that IP address for incomming connections..

Thing I am wondering doesCOS tell you of these attempts at some threshold and I missed it? or does it not have the ability?

Don't leave port 22 open! at the very least if you are change the default port...better still disable root login, and permit only key based connections. Otherwise you leave yourself vulnerable to these kinds of attacks

The IPS does have some brute force type rules but the threshholds are quite high, so it may have gone un-noticed. Make sure the telnet rules are enabled and have a loot at /etc/snort/telnet.rules

Ya I disabled root login, But I never changed the port. I use SSH all the time so I just redirected it to a different port#

Fail2ban or denyhosts should take care of brute force attempts

If you want I wrote a guide on running two factor auth with ssh on clear a while ago, have not tired on 6x yet