Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 17 Jul 2017 06:38:00 -0400 (EDT)
From:      Daniel Feenberg <feenberg@nber.org>
To:        Matthias Apitz <guru@unixarea.de>
Cc:        Paul Schmehl <pschmehl_lists@tx.rr.com>, FreeBSD Questions <freebsd-questions@freebsd.org>
Subject:   Re: sshd logging
Message-ID:  <alpine.LRH.2.20.1707170636550.28890@sas1.nber.org>
In-Reply-To: <20170717051638.GB2368@c720-r314251>
References:  <C96D90F644C8AD0486EB3C91@Pauls-MacBook-Pro.local> <20170717051638.GB2368@c720-r314251>

next in thread | previous in thread | raw e-mail | index | archive | help


On Mon, 17 Jul 2017, Matthias Apitz wrote:

> El día domingo, julio 16, 2017 a las 10:34:42p. m. -0500, Paul Schmehl escribió:
>
>> Is there a way to get sshd to only log successful logins?
>
> What about using ipf(8)?

denyhosts or fail2ban would be easier. You'd still get a few lines in the 
logs, but only a few.

dan feenberg

>
>> The Russians and
>> Chinese are filling up the logs, which turns them over every two hours.
>
> Hmm. Do you mean that the SSH login from NSA and CIA are logged only once
> because the are always successful?
>
> 	matthias
>
>
> -- 
> Matthias Apitz, ✉ guru@unixarea.de, ⌂ http://www.unixarea.de/  ☎ +49-176-38902045
> Public GnuPG key: http://www.unixarea.de/key.pub
> 8. Mai 1945: Wer nicht feiert hat den Krieg verloren.
> 8 de mayo de 1945: Quien no festeja perdió la Guerra.
> May 8, 1945: Who does not celebrate lost the War.
>
From owner-freebsd-questions@freebsd.org  Mon Jul 17 11:21:49 2017
Return-Path: <owner-freebsd-questions@freebsd.org>
Delivered-To: freebsd-questions@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 7F584D7CF0F;
 Mon, 17 Jul 2017 11:21:49 +0000 (UTC)
 (envelope-from smithi@nimnet.asn.au)
Received: from sola.nimnet.asn.au (paqi.nimnet.asn.au [115.70.110.159])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id C86E8818F1;
 Mon, 17 Jul 2017 11:21:48 +0000 (UTC)
 (envelope-from smithi@nimnet.asn.au)
Received: from localhost (localhost [127.0.0.1])
 by sola.nimnet.asn.au (8.14.2/8.14.2) with ESMTP id v6HBLb3k031259;
 Mon, 17 Jul 2017 21:21:37 +1000 (EST)
 (envelope-from smithi@nimnet.asn.au)
Date: Mon, 17 Jul 2017 21:21:37 +1000 (EST)
From: Ian Smith <smithi@nimnet.asn.au>
To: Kulamani Sethi <kulamani.sethi@gmail.com>
cc: freebsd-ipfw@freebsd.org, freebsd-questions@freebsd.org
Subject: Re: Unable to set rule using service name
In-Reply-To: <CAC9ZwGYKxRMJ+K1igQLBN0xVnUyPyMMaHbt0NoQeRg=ocAUf5Q@mail.gmail.com>
Message-ID: <20170717211435.A87076@sola.nimnet.asn.au>
References: <CAC9ZwGaXeZJrCpPu44+9kUmGwgWp8MRaaPjqo5Bs-BmZBkTmbQ@mail.gmail.com>
 <20170715024608.T92704@sola.nimnet.asn.au>
 <CAC9ZwGYKxRMJ+K1igQLBN0xVnUyPyMMaHbt0NoQeRg=ocAUf5Q@mail.gmail.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>;
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Jul 2017 11:21:49 -0000

On Mon, 17 Jul 2017 18:34:10 +0500, Kulamani Sethi wrote:
 > Hi Lan,
 > Thanks for your response!
 > 
 > Yes, it is a placeholders. Here is exact real example of service URL.
 > However it is a Intranet service, you may not access.
 > 
 > service URL1: https://vwddgdptv001.corp.intranet/RISC_1/GDPLogin.aspx
 > 
 > service URL2: https://vwddgdptv001.corp.intranet/GDPT_1/GDPLogin.aspx
 > 
 > Note: RISC_1 and GDPT_1 both are two different service running over a
 > common server.
 > 
 > I want to set some deny rule over RISC_1 only.

I'm sorry, I quite misunderstood your problem (and RW's response).

You cannot use ipfw for this purpose, as it only distinguishes source 
and/or destination IP addresses and/or TCP|UDP port numbers on packets.

You need something to distinguish between URLs, that isn't the firewall 
but something at a higher level, perhaps some sort of proxy?

cheers, Ian

 > *With best Regards,*
 > 
 > Kulamani Sethi,
 > Bangalore, India
 > Mob: 9686190111
 > 
 > On Fri, Jul 14, 2017 at 10:31 PM, Ian Smith <smithi@nimnet.asn.au> wrote:
 > 
 > > On Fri, 14 Jul 2017 16:43:56 +0530, Kulamani Sethi wrote:
 > >  > Hi,
 > >  > I want to set a rule for a particular service URL which running on a
 > > remote
 > >  > server.
 > >  > I know the IP but don't know the port number where that service is
 > > running.
 > >  > If i set rule for IP then it will applied for entire services running
 > > over
 > >  > there.
 > >  >
 > >  > There is a option in IPFW rule we can set either port number or name,
 > > but
 > >  > it does not accepting using name. Here is a example for my case.
 > >  >
 > >  > suppose URL for test1 service  http://x.x.x.x/test1
 > >  >                  URL for test2 service http://x.x.x.x/test2
 > >  >
 > >  > I tried a rule, "ipfw add 104 deny log  ip from x.x.x.x test1 to any".
 > > Got
 > >  > error "ipfw: missing "to'' ".
 > >  > *I want to set rule for test1 where I have no idea about port.*
 > >  > *Also please help me how to know port number if any way is there.*
 > >
 > > RW well described (in freebsd-questions@) the relationship between port
 > > numbers and service names in /etc/services; assuming you know the name,
 > > that gives you the number.  Are 'test1' and 'test2' real examples, or
 > > placeholders for real service names?
 > >
 > > In any case, you cannot specify a port number in a rule with proto 'ip';
 > > when specifying port/s you need to specify 'udp' or 'tcp' protocol.
 > >
 > > Can you give an example of the actual packets (protocol, port number/s)
 > > that you want to block?
 > >
 > > cheers, Ian
 > >
 > _______________________________________________
 > freebsd-ipfw@freebsd.org mailing list
 > https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
 > To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org"



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?alpine.LRH.2.20.1707170636550.28890>