From owner-freebsd-questions@FreeBSD.ORG Fri Mar 5 17:11:52 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 364D410656B8 for ; Fri, 5 Mar 2010 17:11:52 +0000 (UTC) (envelope-from john@starfire.mn.org) Received: from elwood.starfire.mn.org (starfire.skypoint.net [173.8.102.29]) by mx1.freebsd.org (Postfix) with ESMTP id D74418FC3F for ; Fri, 5 Mar 2010 17:10:17 +0000 (UTC) Received: from elwood.starfire.mn.org (john@localhost [127.0.0.1]) by elwood.starfire.mn.org (8.14.3/8.14.3) with ESMTP id o25HA3pJ018944; Fri, 5 Mar 2010 11:10:04 -0600 (CST) (envelope-from john@elwood.starfire.mn.org) Received: (from john@localhost) by elwood.starfire.mn.org (8.14.3/8.14.3/Submit) id o25HA3gf018943; Fri, 5 Mar 2010 11:10:03 -0600 (CST) (envelope-from john) Date: Fri, 5 Mar 2010 11:10:03 -0600 From: John To: Matthew Seaman Message-ID: <20100305171003.GA18881@elwood.starfire.mn.org> References: <20100305125446.GA14774@elwood.starfire.mn.org> <4B910139.1080908@joseph-a-nagy-jr.us> <20100305132604.GC14774@elwood.starfire.mn.org> <20100305154439.GA17456@elwood.starfire.mn.org> <4B912ADC.1040802@infracaninophile.co.uk> <4B91375A.4020503@fechner.net> <4B913983.30900@infracaninophile.co.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4B913983.30900@infracaninophile.co.uk> User-Agent: Mutt/1.4.2.3i Cc: Matthias Fechner , freebsd-questions@freebsd.org Subject: Re: Thousands of ssh probes X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Mar 2010 17:11:52 -0000 On Fri, Mar 05, 2010 at 05:04:03PM +0000, Matthew Seaman wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 05/03/2010 16:54:50, Matthias Fechner wrote: > > Hi, > > > > Am 05.03.10 17:01, schrieb Matthew Seaman: > >> table persist > >> [...near the top of the rules section...] > >> block drop in log quick on $ext_if from > >> > >> [...later in the rules section...] > >> pass in on $ext_if proto tcp \ > >> from any to $ext_if port ssh \ > >> flags S/SA keep state \ > >> (max-src-conn-rate 3/30, overload flush global) > >> > > > > that is dangarous, if you use subversion over ssh you will sometimes get > > more then 10 requests in 30 seconds. > > That means you will also block users they are allowed to connect. > > Yes. Almost all of the time I use this I've also had a ssh-whitelist > table -- addresses that will never be blocked in this way. Like this: > > table persist > table const { \ > 81.187.76.160/29 \ > 2001:8b0:151:1::/64 \ > } persist > > block drop in log quick on $ext_if from > > pass in on $ext_if proto tcp \ > from to $ext_if port ssh \ > flags S/SA keep state > > pass in on $ext_if proto tcp \ > from ! to $ext_if port ssh \ > flags S/SA keep state \ > (max-src-conn-rate 3/30, overload flush global) > Ah. I see. That's clever. Rather than "overriding" the bruteforce list, which would require getting rid of "quick", you use whitelist to prevent things from ever going into the bruteforce table. Nice! I have just switched to pf from ipfw, so I am still learning the nuances and style points. -- John Lind john@starfire.MN.ORG