From owner-freebsd-hackers@FreeBSD.ORG Sat Oct 3 11:43:59 2009 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 78BE61065670 for ; Sat, 3 Oct 2009 11:43:59 +0000 (UTC) (envelope-from rb@gid.co.uk) Received: from mx0.gid.co.uk (mx0.gid.co.uk [194.32.164.250]) by mx1.freebsd.org (Postfix) with ESMTP id 19DC38FC15 for ; Sat, 3 Oct 2009 11:43:58 +0000 (UTC) Received: from gidgate.gid.co.uk (80-46-130-69.static.dsl.as9105.com [80.46.130.69]) by mx0.gid.co.uk (8.14.2/8.14.2) with ESMTP id n93BhvSV079245; Sat, 3 Oct 2009 12:43:58 +0100 (BST) (envelope-from rb@gid.co.uk) Received: from [194.32.164.28] ([194.32.164.6]) by gidgate.gid.co.uk (8.13.8/8.13.8) with ESMTP id n93Bhp4S010199; Sat, 3 Oct 2009 12:43:51 +0100 (BST) (envelope-from rb@gid.co.uk) Message-Id: From: Bob Bishop To: jruohonen@iki.fi In-Reply-To: <20091003081335.GA19914@marx.net.bit> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v936) Date: Sat, 3 Oct 2009 12:43:50 +0100 References: <20091002201039.GA53034@flint.openpave.org> <4AC66E07.4030605@FreeBSD.org> <20091003081335.GA19914@marx.net.bit> X-Mailer: Apple Mail (2.936) Cc: freebsd-hackers@freebsd.org Subject: Re: Distributed SSH attack X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Oct 2009 11:43:59 -0000 Hi, On 3 Oct 2009, at 09:13, Jukka Ruohonen wrote: > While I am well aware that a lot of people use DenyHosts or some > equivalent > tool, I've always been somewhat skeptical about these tools. Few > issues: > > 1. Firewalls should generally be as static as is possible. There is > a reason > why high securelevel prevents modifications to firewalls. > > 2. Generally you do not want some parser to modify your firewall > rules. > Parsing log entries created by remote unauthenticated users as > root is > never a good idea. > > 3. Doing (2) increases the attack surface. > > 4. There have been well-documented cases where (3) has opened > opportunities > for both remote and local DoS. > > Two cents, as they say, > > Jukka. Blackhole routes can be added as an alternative to tweaking firewall rules. The other objections (esp. 3) still apply of course, but these attacks are such a PITA (noise in the logs if nothing else) that one has to do something. -- Bob Bishop rb@gid.co.uk