Date: Fri, 22 Aug 2008 09:48:00 -0400 From: Mike Tancsa <mike@sentex.net> To: Brooks Davis <brooks@freebsd.org> Cc: Mikhail Teterin <mi+mill@aldan.algebra.com>, freebsd-stable@freebsd.org, freebsd-security@freebsd.org Subject: Re: machine hangs on occasion - correlated with ssh break-in attempts Message-ID: <200808221347.m7MDlwaN089762@lava.sentex.ca> In-Reply-To: <20080821203703.GA47728@lor.one-eyed-alien.net> References: <48ADA81E.7090106@aldan.algebra.com> <20080821200309.GA19634@eos.sc1.parodius.com> <20080821201042.GA56182@rink.nu> <20080821203703.GA47728@lor.one-eyed-alien.net>
next in thread | previous in thread | raw e-mail | index | archive | help
At 04:37 PM 8/21/2008, Brooks Davis wrote:
>On Thu, Aug 21, 2008 at 10:10:42PM +0200, Rink Springer wrote:
> > On Thu, Aug 21, 2008 at 01:03:09PM -0700, Jeremy Chadwick wrote:
> > > Finally, consider moving to pf instead, if you really feel ipfw is
> > > what's causing your machine to crash. You might be pleasantly surprised
> > > by the syntax, and overall administrative usability (it is significantly
> > > superior to ipfw, IMHO).
> >
> > In fact, pf can already do this out-of-the-box, by doing something like:
> >
> > table <sshlusers> persist
> > pass quick on $wan_if proto tcp from any to any port ssh flags S/SA keep
> > state \
> > (max-src-conn 15, max-src-conn-rate 5/3, overload <sshlusers> flush
> > global)
> >
> > If that is not an option, I have found that security/denyhosts works
> > pretty well too (it just adds IP's to /etc/hosts.deniedssh, and
> > host_access(5) denies them based on this)
>
>You almost certainly don't want to rate limit ssh connections, only failed
>ones. If you rate limit connections and use svn, you're likely to lock your
>self out.
I find a happy balance is to exclude trusted CIDR blocks from the
rate limiting and let everything else be limited.
e.g.
table <bruteforce> persist
table <SSHTRUSTED> {192.168.0.0/16,1.0.0.0/24}
block log quick proto tcp from <bruteforce> to any port 22
block in log on $ext_if all
pass log quick proto { tcp } from {!<SSHTRUSTED>} to $myaddress port ssh \
flags S/SA keep state \
(max-src-conn 6, max-src-conn-rate 3/30, \
overload <bruteforce> flush global)
pass in on $ext_if inet proto tcp from <SSHTRUSTED> to $ext_if port
ssh keep state
and then a crontab entry
*/5 * * * * /usr/local/sbin/expiretable -v -t 5m bruteforce
---Mike
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200808221347.m7MDlwaN089762>