Date: Mon, 27 Sep 2004 01:44:18 +0200 From: Alex de Kruijff <freebsd@akruijff.dds.nl> To: Willem Jan Withagen <wjw@withagen.nl> Cc: "David D.W. Downey" <david.downey@gmail.com> Subject: Re: Attacks on ssh port Message-ID: <20040926234418.GA1077@alex.lan> In-Reply-To: <41573667.6080509@withagen.nl> References: <414C2798.7060509@withagen.nl> <6917b781040918103077c76f0c@mail.gmail.com> <20040924214909.GA784@alex.lan> <6917b78104092601339f77948@mail.gmail.com> <41573667.6080509@withagen.nl>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Sep 26, 2004 at 11:36:39PM +0200, Willem Jan Withagen wrote: > David D.W. Downey wrote: > > >On Fri, 24 Sep 2004 23:49:09 +0200, Alex de Kruijff > ><freebsd@akruijff.dds.nl> wrote: > > > > > >>>Then you can still see the attempts (and thus log the IP information > >>>for contacting the abuse@ for the responsible IP controller) while > >>>limiting your log sizes. > >>> > >>> > >>This only logs the first tree catches (when the log attribuut is set) > >>per rule. You may want to set this a little higher like 100. > >> > >> > >> > > > >while I agree my example of 3 was low (meant only to instruct) I would > >say more along the lines of 25. if someone is hitting you 25 times in > >a row and getting tagged by that rule, you can bet your butt it's not > >a client of your's. The way I understand it was that the rule doesn't discriminate on the basis of IP. It juist counts them all to gether. But I could be wrong about this. > > > It is even simpler: > Anybody trying to use root as user for ssh-login is not a customer > of mine.... > And if he has not figured out that he's doing something wrong after > 3 tries, little chance that he is really just making a mistake. This is the perspective of sshd. IPFW can't see this and this value is set for all rules. I use the loggin facility mainly as a debugging tool. If I want a certain appliction to work that is being blocked by ipfw, then I flush the rule counters, run the app, check the log file, then add rules based on my findings and then do it all again until I can run the app. My fear is that don't catch te rules you want to catch, if you set this value to low, while with a large(r) value, you still stop the logging. -- Alex Articles based on solutions that I use: http://www.kruijff.org/alex/FreeBSD/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040926234418.GA1077>