Date: Thu, 6 Oct 2005 09:07:57 +0200 From: Enrique Ayesta Perojo <eayesta@portugalete.uned.es> To: Noel Jones <noeldude@gmail.com>, freebsd-questions@freebsd.org Subject: Re: bruteforceblocker + PF Message-ID: <200510060907.57922.eayesta@portugalete.uned.es> In-Reply-To: <cce506b0510051253r2ca4f6eeg618238d94d468fb8@mail.gmail.com> References: <200510051204.54331.eayesta@portugalete.uned.es> <cce506b0510051253r2ca4f6eeg618238d94d468fb8@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
El Mi=E9rcoles, 5 de Octubre de 2005 21:53, Noel Jones escribi=F3:
> I'm going to assume this is just a small part of your pf.conf, because
> the part you show doesn't allow any internet access. Maybe you should
> show us your entire pf.conf.
Yes, it was a small part of my pf.conf. Anyway i'm trying on another machin=
e=20
with a much smaller configuration with the same results. I think it should =
be=20
enough for bruteforceblocker to work
***/etc/pf.conf***
table <bruteforce> persist file "/var/log/bruteforce"
=20
# options
set block-policy return
set loginterface bge0
# scrub
scrub in all
# filter rules
pass all
block in log quick inet proto tcp from <bruteforce> to any port ssh
> Do your rules display as expected?
> # pfctl -s rules
Yes, they display as expected
No ALTQ support in kernel
ALTQ related functions disabled
scrub in all fragment reassemble
pass all
block return in log quick inet proto tcp from <bruteforce> to any port =3D =
ssh
> Did you reload pf after you edited pf.conf?
> # pfctl -f /etc/pf.conf
Yes, i did
> Are you testing this from outside the 10.200.x.x network?
Yes
> In your auth.log do you see bruteforceblocker messages such as:
>
> 220.92.126.217 was logged with total count of 1.
>
> when an ssh login fails?
> And then after $max_attempts is exceeded you should see:
>
> IP 202.92.126.217 reached the maximum number of failed attempts!!!
> Adding IP to the firewall...
No, i don't see any of these messages, the only message i see is the start =
of=20
the log:
!!!!!!! log started at Wed Oct 5 18:53:23 2005 !!!!!!!
I cannot figure what's the problem, the bruteforce table remains clean afte=
r=20
the tests, but the bruteforce blocker is running in the system apparently=20
whithout any problems as i have checked with ps.
Thanks
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200510060907.57922.eayesta>