From owner-freebsd-questions@FreeBSD.ORG Sat Feb 5 20:33:51 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5583B16A4CE for ; Sat, 5 Feb 2005 20:33:51 +0000 (GMT) Received: from wproxy.gmail.com (wproxy.gmail.com [64.233.184.201]) by mx1.FreeBSD.org (Postfix) with ESMTP id 5093D43D1F for ; Sat, 5 Feb 2005 20:33:49 +0000 (GMT) (envelope-from dvanallen@gmail.com) Received: by wproxy.gmail.com with SMTP id 69so551708wra for ; Sat, 05 Feb 2005 12:33:48 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:reply-to:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:references; b=aZ7q+Wnw3Iv6BRKgRtKB26aDvFIWFQrxbK4UDK9aq3UqJ2II9ORAMfbARLHgXTtw4RJiejmDjbTlm2oWH9LnKx40/hs9m81OR+kMY9TLcytqdzqYQwXCyCte3x37dRiivBnT8vTLXgbu3CAsuQQJXWe188COCcO0EZvAGPacW6o= Received: by 10.54.24.73 with SMTP id 73mr208042wrx; Sat, 05 Feb 2005 12:33:48 -0800 (PST) Received: by 10.54.22.48 with HTTP; Sat, 5 Feb 2005 12:33:48 -0800 (PST) Message-ID: <2063a95c0502051233a9495ee@mail.gmail.com> Date: Sat, 5 Feb 2005 15:33:48 -0500 From: Doug Van Allen To: freebsd-questions@freebsd.org, Kevin Kinsey In-Reply-To: <42051E06.1050508@daleco.biz> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit References: <2063a95c05020509493b35ee0d@mail.gmail.com> <42051E06.1050508@daleco.biz> Subject: Re: Can't ssh to server X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: Doug Van Allen List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Feb 2005 20:33:51 -0000 # Start by allowing everything (this prevents the rest of the file # from working, so remove it when you need protection). # The rules here work on a "First match wins" basis. #ALL : ALL : allow ALL : 192.168.1. : allow ALL : 151.xxx.xxx.xxx-151.xxx.xxx.xxx : allow ALL : 127.0.0.1 : allow # Wrapping sshd(8) is not normally a good idea, but if you # need to do it, here's how #sshd : .evil.cracker.example.com : deny # Protect against simple DNS spoofing attacks by checking that the # forward and reverse records for the remote host match. If a mismatch # occurs, access is denied, and any positive ident response within # 20 seconds is logged. No protection is afforded against DNS poisoning, # IP spoofing or more complicated attacks. Hosts with no reverse DNS # pass this rule. ALL : PARANOID : RFC931 20 : deny # Allow anything from localhost. Note that an IP address (not a host # name) *MUST* be specified for rpcbind(8). ALL : localhost 127.0.0.1 [::1] : allow ALL : 192.168.1.75 : allow # To use IPv6 addresses you must enclose them in []'s #ALL : [fe80::%fxp0]/10 : allow #ALL : [fe80::]/10 : deny #ALL : [2001:db8:2:1:2:3:4:3fe1] : deny #ALL : [2001:db8:2:1::]/64 : allow # Sendmail can help protect you against spammers and relay-rapers sendmail : localhost : allow sendmail : .nice.guy.example.com : allow sendmail : .evil.cracker.example.com : deny sendmail : ALL : allow # Exim is an alternative to sendmail, available in the ports tree exim : localhost : allow exim : .nice.guy.example.com : allow exim : .evil.cracker.example.com : deny exim : ALL : allow # Rpcbind is used for all RPC services; protect your NFS! # (IP addresses rather than hostnames *MUST* be used here) rpcbind : 192.0.2.32/255.255.255.224 : allow rpcbind : 192.0.2.96/255.255.255.224 : allow rpcbind : ALL : deny # NIS master server. Only local nets should have access ypserv : localhost : allow ypserv : .unsafe.my.net.example.com : deny ypserv : .my.net.example.com : allow ypserv : ALL : deny # Provide a small amount of protection for ftpd ftpd : localhost : allow ftpd : .nice.guy.example.com : allow ftpd : .evil.cracker.example.com : deny ftpd : ALL : allow # You need to be clever with finger; do _not_ backfinger!! You can easily # start a "finger war". fingerd : ALL \ : spawn (echo Finger. | \ /usr/bin/mail -s "tcpd\: %u@%h[%a] fingered me!" root) & \ : deny # The rest of the daemons are protected. ALL : ALL \ : severity auth.info \ : twist /bin/echo "You are not welcome to use %d from %h." On Sat, 05 Feb 2005 13:27:02 -0600, Kevin Kinsey wrote: > Doug Van Allen wrote: > > >I'm running FreeBSD 5.3 and I'm trying to connect to it from school > >using ssh. At school, I get connection refused. I checked the > >auth.log and found: > > > >Feb 3 21:23:05 FreeBSD sshd[44237]: twist xxxxx.xxxx.edu to /bin/echo > >"You are not welcome to use sshd from xxxxx.xxxx.edu." > > > >I ran tcpdmatch and got: > > > >$ tcpdmatch sshd bt20510.hvcc.edu > >warning: sshd: no such process name in /etc/inetd.conf > >client: hostname bt20510.hvcc.edu > >client: address 151.103.21.131 > >server: process sshd > >matched: /etc/hosts.allow line 91 > >option: severity auth.info > >option: twist /bin/echo "You are not welcome to use sshd from > >bt20510.hvcc.edu." > > > >I have made changes to hosts.allow to only allow my local network and > >the ip's of the workstations from school. I am running PF and only > >allowed the same rules. So what gives? > > > > > > Can you show the pertinent lines from /etc/hosts.allow? > > Kevin Kinsey >