Re: [tor-relays] Intrusion Prevention System Software - Snort or Suricata

On Wed, 05 Oct 2016 13:48:19 +0000, Mirimir wrote: ...

exits unpredictably unreliable. On the other hand, IPS that only blocked automated crap would be a win for real users, relay operators and ISPs, no? Why should "... ssh foo@w.x.y.z ... ssh bar@w.x.y.z ... ssh baz@w.x.y.z ..." get through, if it destroys exits? Maybe someone could forget their username. But maybe after 10-20 tries, can't we safely assume that they're brute forcing logins?

No.

for i in subdir/*; do ssh host mkdir -p "$i"; done

with an ssh-agent would look pretty exactly the same to the exit node.

Andreas