From owner-freebsd-questions@freebsd.org Mon Jul 17 11:00:11 2017 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 8ECF9D7C800 for ; Mon, 17 Jul 2017 11:00:11 +0000 (UTC) (envelope-from feenberg@nber.org) Received: from mail2.nber.org (mail2.nber.org [198.71.6.79]) by mx1.freebsd.org (Postfix) with ESMTP id 3C8D480CF9 for ; Mon, 17 Jul 2017 11:00:10 +0000 (UTC) (envelope-from feenberg@nber.org) Received: from sas1.nber.org (sas1.nber.org [198.71.6.89]) by mail2.nber.org (8.15.2/8.15.2) with ESMTPS id v6HAc0Lo032274 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 17 Jul 2017 06:38:01 -0400 (EDT) (envelope-from feenberg@nber.org) Date: Mon, 17 Jul 2017 06:38:00 -0400 (EDT) From: Daniel Feenberg To: Matthias Apitz cc: Paul Schmehl , FreeBSD Questions Subject: Re: sshd logging In-Reply-To: <20170717051638.GB2368@c720-r314251> Message-ID: References: <20170717051638.GB2368@c720-r314251> User-Agent: Alpine 2.20 (LRH 67 2015-01-07) MIME-Version: 1.0 X-KLMS-Rule-ID: 1 X-KLMS-Message-Action: clean X-KLMS-AntiSpam-Status: not scanned, disabled by settings X-KLMS-AntiSpam-Interceptor-Info: not scanned X-KLMS-AntiPhishing: Clean, 2017/07/14 10:36:23 X-KLMS-AntiVirus: Kaspersky Security 8.0 for Linux Mail Server, version 8.0.1.721, bases: 2017/07/17 05:49:00 #10096095 X-KLMS-AntiVirus-Status: Clean, skipped Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8BIT X-Content-Filtered-By: Mailman/MimeDel 2.1.23 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Jul 2017 11:00:11 -0000 On Mon, 17 Jul 2017, Matthias Apitz wrote: > El día domingo, julio 16, 2017 a las 10:34:42p. m. -0500, Paul Schmehl escribió: > >> Is there a way to get sshd to only log successful logins? > > What about using ipf(8)? denyhosts or fail2ban would be easier. You'd still get a few lines in the logs, but only a few. dan feenberg > >> The Russians and >> Chinese are filling up the logs, which turns them over every two hours. > > Hmm. Do you mean that the SSH login from NSA and CIA are logged only once > because the are always successful? > > matthias > > > -- > Matthias Apitz, ✉ guru@unixarea.de, ⌂ http://www.unixarea.de/ ☎ +49-176-38902045 > Public GnuPG key: http://www.unixarea.de/key.pub > 8. Mai 1945: Wer nicht feiert hat den Krieg verloren. > 8 de mayo de 1945: Quien no festeja perdió la Guerra. > May 8, 1945: Who does not celebrate lost the War. > From owner-freebsd-questions@freebsd.org Mon Jul 17 11:21:49 2017 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 7F584D7CF0F; Mon, 17 Jul 2017 11:21:49 +0000 (UTC) (envelope-from smithi@nimnet.asn.au) Received: from sola.nimnet.asn.au (paqi.nimnet.asn.au [115.70.110.159]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id C86E8818F1; Mon, 17 Jul 2017 11:21:48 +0000 (UTC) (envelope-from smithi@nimnet.asn.au) Received: from localhost (localhost [127.0.0.1]) by sola.nimnet.asn.au (8.14.2/8.14.2) with ESMTP id v6HBLb3k031259; Mon, 17 Jul 2017 21:21:37 +1000 (EST) (envelope-from smithi@nimnet.asn.au) Date: Mon, 17 Jul 2017 21:21:37 +1000 (EST) From: Ian Smith To: Kulamani Sethi cc: freebsd-ipfw@freebsd.org, freebsd-questions@freebsd.org Subject: Re: Unable to set rule using service name In-Reply-To: Message-ID: <20170717211435.A87076@sola.nimnet.asn.au> References: <20170715024608.T92704@sola.nimnet.asn.au> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Jul 2017 11:21:49 -0000 On Mon, 17 Jul 2017 18:34:10 +0500, Kulamani Sethi wrote: > Hi Lan, > Thanks for your response! > > Yes, it is a placeholders. Here is exact real example of service URL. > However it is a Intranet service, you may not access. > > service URL1: https://vwddgdptv001.corp.intranet/RISC_1/GDPLogin.aspx > > service URL2: https://vwddgdptv001.corp.intranet/GDPT_1/GDPLogin.aspx > > Note: RISC_1 and GDPT_1 both are two different service running over a > common server. > > I want to set some deny rule over RISC_1 only. I'm sorry, I quite misunderstood your problem (and RW's response). You cannot use ipfw for this purpose, as it only distinguishes source and/or destination IP addresses and/or TCP|UDP port numbers on packets. You need something to distinguish between URLs, that isn't the firewall but something at a higher level, perhaps some sort of proxy? cheers, Ian > *With best Regards,* > > Kulamani Sethi, > Bangalore, India > Mob: 9686190111 > > On Fri, Jul 14, 2017 at 10:31 PM, Ian Smith wrote: > > > On Fri, 14 Jul 2017 16:43:56 +0530, Kulamani Sethi wrote: > > > Hi, > > > I want to set a rule for a particular service URL which running on a > > remote > > > server. > > > I know the IP but don't know the port number where that service is > > running. > > > If i set rule for IP then it will applied for entire services running > > over > > > there. > > > > > > There is a option in IPFW rule we can set either port number or name, > > but > > > it does not accepting using name. Here is a example for my case. > > > > > > suppose URL for test1 service http://x.x.x.x/test1 > > > URL for test2 service http://x.x.x.x/test2 > > > > > > I tried a rule, "ipfw add 104 deny log ip from x.x.x.x test1 to any". > > Got > > > error "ipfw: missing "to'' ". > > > *I want to set rule for test1 where I have no idea about port.* > > > *Also please help me how to know port number if any way is there.* > > > > RW well described (in freebsd-questions@) the relationship between port > > numbers and service names in /etc/services; assuming you know the name, > > that gives you the number. Are 'test1' and 'test2' real examples, or > > placeholders for real service names? > > > > In any case, you cannot specify a port number in a rule with proto 'ip'; > > when specifying port/s you need to specify 'udp' or 'tcp' protocol. > > > > Can you give an example of the actual packets (protocol, port number/s) > > that you want to block? > > > > cheers, Ian > > > _______________________________________________ > freebsd-ipfw@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org"