From owner-freebsd-questions@FreeBSD.ORG  Tue Nov 14 23:24:02 2006
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 3062716A40F
	for <freebsd-questions@freebsd.org>;
	Tue, 14 Nov 2006 23:24:02 +0000 (UTC)
	(envelope-from norgaard@locolomo.org)
Received: from strange.daemonsecurity.com
	(59.Red-81-33-11.staticIP.rima-tde.net [81.33.11.59])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 8417643D6B
	for <freebsd-questions@freebsd.org>;
	Tue, 14 Nov 2006 23:24:01 +0000 (GMT)
	(envelope-from norgaard@locolomo.org)
Received: from [10.35.4.65] (65.4-35-10-static.chueca.wifi [10.35.4.65])
	by strange.daemonsecurity.com (Postfix) with ESMTP id 7C23E2E05C;
	Wed, 15 Nov 2006 00:24:00 +0100 (CET)
Message-ID: <455A4FA1.5010601@locolomo.org>
Date: Wed, 15 Nov 2006 00:22:09 +0100
From: Erik Norgaard <norgaard@locolomo.org>
User-Agent: Thunderbird 1.5.0.7 (X11/20061022)
MIME-Version: 1.0
To: "Peter N. M. Hansteen" <peter@bgnett.no>
References: <4558D2A3.50904@locolomo.org> <8764di7a2r.fsf@thingy.datadok.no>
In-Reply-To: <8764di7a2r.fsf@thingy.datadok.no>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: freebsd-questions@freebsd.org
Subject: Re: Blocking SSH Brute-Force Attacks: What Am I Doing Wrong?
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 14 Nov 2006 23:24:02 -0000

Peter N. M. Hansteen wrote:
> Erik Norgaard <norgaard@locolomo.org> writes:
> 
>> Honestly, I wouldn't worry about it: review your config and make some 
>> simple choices to reduce the noise, see this article:
> 
> One other noise reduction method which is really easy to implement is
> to use pf and write arule set which to uses the overload feature, see
> eg http://home.nuug.no/~peter/pf/en/bruteforce.html (part of my
> EuroBSDCon and other places tutorial).
> 
> See http://home.nuug.no/~peter/pf/ for a choice of formats and languages.
> 
Neat!

Thanks, Erik

-- 
Ph: +34.666334818                      web: http://www.locolomo.org
X.509 Certificate: http://www.locolomo.org/crt/8D03551FFCE04F0C.crt
Key ID: 69:79:B8:2C:E3:8F:E7:BE:5D:C3:C3:B1:74:62:B8:3F:9F:1F:69:B9