Date: Sun, 26 Jun 2005 17:49:01 +0200 From: Max Laier <max@love2party.net> To: freebsd-pf@freebsd.org Subject: Re: Outbound SSH problem Message-ID: <200506261749.08529.max@love2party.net> In-Reply-To: <200506251645.j5PGjoRb028520@outbound1.mail.tds.net> References: <200506251645.j5PGjoRb028520@outbound1.mail.tds.net>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On Saturday 25 June 2005 18:45, Ninneman, TJ wrote: > I'm having some trouble on both my 5.3 and 5.4 FreeBSD servers running PF. > My ruleset explicitly blocks outbound ssh from my servers to prevent > attacks on other servers in the event that one of my servers is > compromised. The problem is that I have noticed (after a few days of the > server being up) my daily run output showing both TCP and UDP packets being > dropped outbound: > > block drop out quick on em0 proto tcp from any to any port = ssh [ > Evaluations: 437 Packets: 0 Bytes: 0 States: 0 ] ~~~~~~~~~~~ ^ ^ > > block drop out quick on em0 proto udp from any to any port = ssh [ > Evaluations: 1505 Packets: 0 Bytes: 0 States: 0 ] ~~~~~~~~~~~ ^ ^ > My question is, are my servers compromised or am I misreading the run > output? You are misreading the output. The "Evaluations" counter only shows that a packet was checked against the rule, unless Packets and Bytes are not increased, the packet didn't match. You could check that yourself: Just try to make a ssh connection from the server in question and see how the Packets/Bytes counter increase. -- /"\ Best regards, | mlaier@freebsd.org \ / Max Laier | ICQ #67774661 X http://pf4freebsd.love2party.net/ | mlaier@EFnet / \ ASCII Ribbon Campaign | Against HTML Mail and News [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (FreeBSD) iD8DBQBCvs50XyyEoT62BG0RAorhAJ0c14oPBJV3tY5J+VBOHwkB+BTNwgCfV+Fm lSyvKaKRric7pNqVWTt8Te0= =MCBZ -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200506261749.08529.max>