Date: Tue, 20 Sep 2011 00:19:50 +0200 From: suxor <suxor@ich.ms> To: freebsd-questions@freebsd.org Subject: Re: limit number of ssh connections Message-ID: <1316470791.2848.2.camel@localhost> In-Reply-To: <CAAOvGP2Gj0=ZAYZn2KZYUa3NTCHVtUdtQqHumM1D5Ea26dzPrQ@mail.gmail.com> References: <CAAOvGP2Gj0=ZAYZn2KZYUa3NTCHVtUdtQqHumM1D5Ea26dzPrQ@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
> Does anyone know a good way of limiting the number of ssh attempts > from a single IP address? > > I found the following website, which describes a variety of approaches: > > http://www.freebsdwiki.net/index.php/Block_repeated_illegal_or_failed_SSH_logins > > > But I am honestly not really happy with any of them. Continuously > polling log files for regex hits seems...well crude. Just to give you > an idea of what I mean, here were some of the issues I had. The > sshd-scan.sh script allows IPs to be reinstated, but the timing is > dependent on how frequently you rotate logs. sshguard has a pretty > website, but I can't actually find much useful documentation on how to > configure it. fail2ban looks like it might work with sufficient work, > but the defaults are terrible. By default, every time an IP is > reinstated, all IPs are reinstated. Not to mention, at present I > can't seem to get it to trigger any hits. > > I suppose I could keep shopping, but the truth is I just think polling > log files is the wrong way to solve the problem. Anything based on > this approach is going to have a long latency and be highly dependent > on the unspecified and unstable formatting of log files (see > http://www.fail2ban.org/wiki/index.php/HOWTO_Mac_OS_X_Server_(10.4) > and the troubles an exclamation point can cause). > > I would much much rather do something like this: > > http://kevin.vanzonneveld.net/techblog/article/block_brute_force_attacks_with_iptables/ > > Does anyone know a way to do something similar with ipfw? > > > Thanks in advance, > Jim Maybe you mean something like this?! http://home.nuug.no/~peter/pf/en/bruteforce.html
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1316470791.2848.2.camel>