From owner-freebsd-stable@FreeBSD.ORG  Thu Aug 21 20:25:00 2008
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id DE4F4106567C;
	Thu, 21 Aug 2008 20:25:00 +0000 (UTC) (envelope-from rink@rink.nu)
Received: from mx1.rink.nu (gloom.rink.nu [213.34.49.2])
	by mx1.freebsd.org (Postfix) with ESMTP id 99DC08FC1C;
	Thu, 21 Aug 2008 20:25:00 +0000 (UTC) (envelope-from rink@rink.nu)
Received: from localhost (localhost [127.0.0.1])
	by mx1.rink.nu (Postfix) with ESMTP id 609B26D455;
	Thu, 21 Aug 2008 22:10:52 +0200 (CEST)
X-Virus-Scanned: amavisd-new at rink.nu
Received: from mx1.rink.nu ([213.34.49.2])
	by localhost (gloom.rink.nu [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id wNMVCXqmMilc; Thu, 21 Aug 2008 22:10:42 +0200 (CEST)
Received: by mx1.rink.nu (Postfix, from userid 1000)
	id B19D56D454; Thu, 21 Aug 2008 22:10:42 +0200 (CEST)
Date: Thu, 21 Aug 2008 22:10:42 +0200
From: Rink Springer <rink@FreeBSD.org>
To: Jeremy Chadwick <koitsu@FreeBSD.org>
Message-ID: <20080821201042.GA56182@rink.nu>
References: <48ADA81E.7090106@aldan.algebra.com>
	<20080821200309.GA19634@eos.sc1.parodius.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20080821200309.GA19634@eos.sc1.parodius.com>
User-Agent: Mutt/1.5.18 (2008-05-17)
Cc: Mikhail Teterin <mi+mill@aldan.algebra.com>, freebsd-stable@FreeBSD.org,
	freebsd-security@freebsd.org
Subject: Re: machine hangs on occasion - correlated with ssh break-in
	attempts
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>, 
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 21 Aug 2008 20:25:01 -0000

On Thu, Aug 21, 2008 at 01:03:09PM -0700, Jeremy Chadwick wrote:
> Finally, consider moving to pf instead, if you really feel ipfw is
> what's causing your machine to crash.  You might be pleasantly surprised
> by the syntax, and overall administrative usability (it is significantly
> superior to ipfw, IMHO).

In fact, pf can already do this out-of-the-box, by doing something like:

table <sshlusers> persist
pass quick on $wan_if proto tcp from any to any port ssh flags S/SA keep
state \
     (max-src-conn 15, max-src-conn-rate 5/3, overload <sshlusers> flush
global)

If that is not an option, I have found that security/denyhosts works
pretty well too (it just adds IP's to /etc/hosts.deniedssh, and
host_access(5) denies them based on this)

Regards,

-- 
Rink P.W. Springer                                - http://rink.nu
"Anyway boys, this is America. Just because you get more votes doesn't
 mean you win." - Fox Mulder