Date: Tue, 29 Aug 2006 21:21:48 +0200 From: Pieter de Boer <pieter@thedarkside.nl> To: freebsd-security@freebsd.org Subject: Re: SSH scans vs connection ratelimiting Message-ID: <44F493CC.4000205@thedarkside.nl> In-Reply-To: <44E76B21.8000409@thedarkside.nl> References: <44E76B21.8000409@thedarkside.nl>
next in thread | previous in thread | raw e-mail | index | archive | help
Just to put an end to this sillyness :) A few days ago, I wrote: > For months now, we're all seeing repeated bruteforce attempts on SSH. > I've configured my pf install to ratelimit TCP connections to port 22 > and to automatically add IP-addresses that connect too fast to a table > that's filtered: <snip> > This works as expected, IP-addresses are added to the 'lamers'-table > every once in a while. > > However, there apparently are SSH bruteforcers that simply use one > connection to perform a brute-force attack: As mysteries go, this one was a PEBKAC, too. My pf config had a 'deny all'-statement, but only for the external interface. A tunnel interface wasn't filtered in any way and no ratelimiting was taking place for the SSH daemon bound on that tunnel interface's address, hence the succeeding scans. Sorry for the confusion, Pieter
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?44F493CC.4000205>