Doug, What was he name if the "automatic IP blocking" process you mentioned last night. I guess I should have been taking notes. I'm currently using my own python program that reads /var/log/secure looking for failed login attempts and selected user names that hackers frequently use. Thanks, Dennis