Date: Wed, 21 Mar 2007 17:50:42 +0300 From: Eygene Ryabinkin <rea-fbsd@codelabs.ru> To: Bill Moran <wmoran@collaborativefusion.com> Cc: freebsd-security@freebsd.org, "W. D." <WD@US-Webmasters.com> Subject: Re: Reality check: IPFW sees SSH traffic that sshd does not? Message-ID: <20070321145041.GG14837@codelabs.ru> In-Reply-To: <20070321103006.c57729cc.wmoran@collaborativefusion.com> References: <20070321123033.GD31533@bunrab.catwhisker.org> <20070321092724.fd6f1541.wmoran@collaborativefusion.com> <20070321103006.c57729cc.wmoran@collaborativefusion.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Wed, Mar 21, 2007 at 10:30:06AM -0400, Bill Moran wrote: > In response to "W. D." <WD@US-Webmasters.com>: > > > At 08:27 3/21/2007, Bill Moran, wrote: > > I run a little script I wrote that automatically adds > > >failed SSH attempts to a table that blocks them from _everything_ in my > > >pf rules. > > > > Do you care to share that script? > > It's pretty basic, but I will share it. I've been waiting until I'd been > using it for a while to make sure there weren't any problems. You can use the following rule that will put very fast SSH connectors to the pf table ssh_scans: ----- pass in quick on $iface proto tcp from any to $ip port 22 flags S/AUSPF \ keep state (max-src-conn 4, max-src-conn-rate 6/1, overload <ssh_scans> flush) ----- and you can do whatever you like with the ssh_scans table in your pf ruleset. It is just another option to throttle SSH scans with the pf, though you should whitelist the good known hosts that are doing massive numbers of SSH connections to your host. And you can use the expiretable port to expire the entries in the ssh_scans. Not a silver bullet, but proved to be useful at some configurations. -- Eygene
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070321145041.GG14837>