From owner-freebsd-stable@FreeBSD.ORG  Thu Aug 21 20:36:31 2008
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 6CD2F1065674;
	Thu, 21 Aug 2008 20:36:31 +0000 (UTC)
	(envelope-from brooks@lor.one-eyed-alien.net)
Received: from lor.one-eyed-alien.net (cl-162.ewr-01.us.sixxs.net
	[IPv6:2001:4830:1200:a1::2])
	by mx1.freebsd.org (Postfix) with ESMTP id D87FD8FC14;
	Thu, 21 Aug 2008 20:36:30 +0000 (UTC)
	(envelope-from brooks@lor.one-eyed-alien.net)
Received: from lor.one-eyed-alien.net (localhost [127.0.0.1])
	by lor.one-eyed-alien.net (8.14.2/8.14.2) with ESMTP id m7LKb3oq047754; 
	Thu, 21 Aug 2008 15:37:03 -0500 (CDT)
	(envelope-from brooks@lor.one-eyed-alien.net)
Received: (from brooks@localhost)
	by lor.one-eyed-alien.net (8.14.2/8.14.2/Submit) id m7LKb3AZ047753;
	Thu, 21 Aug 2008 15:37:03 -0500 (CDT) (envelope-from brooks)
Date: Thu, 21 Aug 2008 15:37:03 -0500
From: Brooks Davis <brooks@freebsd.org>
To: Rink Springer <rink@freebsd.org>
Message-ID: <20080821203703.GA47728@lor.one-eyed-alien.net>
References: <48ADA81E.7090106@aldan.algebra.com>
	<20080821200309.GA19634@eos.sc1.parodius.com>
	<20080821201042.GA56182@rink.nu>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="82I3+IH0IqGh5yIs"
Content-Disposition: inline
In-Reply-To: <20080821201042.GA56182@rink.nu>
User-Agent: Mutt/1.5.17 (2007-11-01)
Cc: Mikhail Teterin <mi+mill@aldan.algebra.com>,
	Jeremy Chadwick <koitsu@freebsd.org>, freebsd-stable@freebsd.org,
	freebsd-security@freebsd.org
Subject: Re: machine hangs on occasion - correlated with ssh break-in
	attempts
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>, 
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 21 Aug 2008 20:36:31 -0000


--82I3+IH0IqGh5yIs
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Aug 21, 2008 at 10:10:42PM +0200, Rink Springer wrote:
> On Thu, Aug 21, 2008 at 01:03:09PM -0700, Jeremy Chadwick wrote:
> > Finally, consider moving to pf instead, if you really feel ipfw is
> > what's causing your machine to crash.  You might be pleasantly surprised
> > by the syntax, and overall administrative usability (it is significantly
> > superior to ipfw, IMHO).
>=20
> In fact, pf can already do this out-of-the-box, by doing something like:
>=20
> table <sshlusers> persist
> pass quick on $wan_if proto tcp from any to any port ssh flags S/SA keep
> state \
>      (max-src-conn 15, max-src-conn-rate 5/3, overload <sshlusers> flush
> global)
>=20
> If that is not an option, I have found that security/denyhosts works
> pretty well too (it just adds IP's to /etc/hosts.deniedssh, and
> host_access(5) denies them based on this)

You almost certainly don't want to rate limit ssh connections, only failed
ones.  If you rate limit connections and use svn, you're likely to lock your
self out.

-- Brooks

--82I3+IH0IqGh5yIs
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (FreeBSD)

iD8DBQFIrdHuXY6L6fI4GtQRAnmFAJsHxkpSK8Zx3QWdr/ksFolpRXNtIgCgyEbc
WqAu2UPpH5xE7+ZF0xj8b+U=
=qS2/
-----END PGP SIGNATURE-----

--82I3+IH0IqGh5yIs--