From owner-freebsd-pf@FreeBSD.ORG Thu Feb 10 15:30:29 2011 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id BA18E106564A for ; Thu, 10 Feb 2011 15:30:29 +0000 (UTC) (envelope-from Daniel.Hartmeier@swisscom.com) Received: from mail.swisscom.com (outmail100.swisscom.com [193.222.81.100]) by mx1.freebsd.org (Postfix) with ESMTP id 4F4448FC1A for ; Thu, 10 Feb 2011 15:30:28 +0000 (UTC) Received: by intmail1.corproot.net; Thu, 10 Feb 2011 15:56:58 +0100 From: To: Date: Thu, 10 Feb 2011 15:56:56 +0100 Thread-Topic: brutal SSH attacks Thread-Index: AcvJK1q74TwAqrznRz2C5wmZPYn8RQAAlaFQ Message-ID: References: <5A0B04327C334DA18745BFDBDBECE055@charlieroot.de> <98689EFE59404E4B838E79071AABA8B4@charlieroot.de> <56413CA2-EE4F-4E06-B044-0982E864E44D@gmail.com> <20110209185118.GA16942@insomnia.benzedrine.cx> <20110210075258.GB16942@insomnia.benzedrine.cx> <94DFDF09-6C43-4A4D-B76A-FDFBF7C588B6@gmail.com> In-Reply-To: <94DFDF09-6C43-4A4D-B76A-FDFBF7C588B6@gmail.com> Accept-Language: de-DE, de-CH Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: de-DE, de-CH Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: freebsd-pf@freebsd.org Subject: RE: brutal SSH attacks X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Feb 2011 15:30:29 -0000 Ah, so I guess this does deserve some further debugging :) First, make sure those connections are matching the expected rule: Watch an ongoing scan, note the scanner's IP. Run # pfctl -vvss | grep -A 2 Note the rule number printed right-most in every third line, and compare th= em to the output of # pfctl -gsr i.e. for each state entry, find the rule with the corresponding rule number= (the left-most @nr). Is it always the same rule, and does it have max-src-conn-rate/overload? Th= is should also be the same rule number shown for pflog (e.g. "rule 5/0(match)"). Second, verify that the source node is being tracked: # pfctl -vvsS | grep -A 1 -> 0.0.0.0 ( states 8, connections 8, rate 7.9/60s ) age 00:00:01, 72 pkts, 9384 bytes, filter rule 105 If it's found, how does it change as the scan progresses? If it's not found, check if you're hitting the limit of source nodes: # pfctl -sS | wc -l 9025 # pfctl -sm src-nodes hard limit 10000 (it can be increased in pf.conf with set limit src-nodes ) Third, exclude the possibility that it did get added to the table, but some= how got removed again: If you watch an ongoing scan, see the source tracking node getting updated = to the limit, and then check # pfctl -t abusive_hosts -vvTt do you get a match? Are you running anything manually or through cron that might manipulate or = flush the table, like a (often superfluous) pfctl -Fa when reloading the ruleset? Regards, Daniel