Date: Sun, 26 Jun 2005 17:49:01 +0200 From: Max Laier <max@love2party.net> To: freebsd-pf@freebsd.org Subject: Re: Outbound SSH problem Message-ID: <200506261749.08529.max@love2party.net> In-Reply-To: <200506251645.j5PGjoRb028520@outbound1.mail.tds.net> References: <200506251645.j5PGjoRb028520@outbound1.mail.tds.net>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart1362967.UoEKuS5aSD Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline On Saturday 25 June 2005 18:45, Ninneman, TJ wrote: > I'm having some trouble on both my 5.3 and 5.4 FreeBSD servers running PF. > My ruleset explicitly blocks outbound ssh from my servers to prevent > attacks on other servers in the event that one of my servers is > compromised. The problem is that I have noticed (after a few days of the > server being up) my daily run output showing both TCP and UDP packets bei= ng > dropped outbound: > > block drop out quick on em0 proto tcp from any to any port =3D ssh [ > Evaluations: 437 Packets: 0 Bytes: 0 States: 0 ] ~~~~~~~~~~~ ^ ^ > > block drop out quick on em0 proto udp from any to any port =3D ssh [ > Evaluations: 1505 Packets: 0 Bytes: 0 States: 0 ] ~~~~~~~~~~~ ^ ^ > My question is, are my servers compromised or am I misreading the run > output? You are misreading the output. The "Evaluations" counter only shows that a= =20 packet was checked against the rule, unless Packets and Bytes are not=20 increased, the packet didn't match. You could check that yourself: Just try to make a ssh connection from the= =20 server in question and see how the Packets/Bytes counter increase. =2D-=20 /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News --nextPart1362967.UoEKuS5aSD Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (FreeBSD) iD8DBQBCvs50XyyEoT62BG0RAorhAJ0c14oPBJV3tY5J+VBOHwkB+BTNwgCfV+Fm lSyvKaKRric7pNqVWTt8Te0= =MCBZ -----END PGP SIGNATURE----- --nextPart1362967.UoEKuS5aSD--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200506261749.08529.max>