Date: Tue, 25 Aug 2009 08:18:12 -0700 From: George Davidovich <freebsd@optimis.net> To: freebsd-pf@freebsd.org Subject: Re: something like bruteblock for pf? Message-ID: <20090825151812.GA75010@marvin.optimis.net> In-Reply-To: <200908231748187.SM01728@W500.Go2France.com> References: <200908230132343.SM01728@W500.Go2France.com> <a2b6592c0908221807q24e7f54aka75b561debca63eb@mail.gmail.com> <200908230340125.SM01728@W500.Go2France.com> <7731938b0908221957g2150a2f0p3263b6cab72bdf81@mail.gmail.com> <4A914FD1.7070500@bals.org> <200908231748187.SM01728@W500.Go2France.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Aug 23, 2009 at 10:49:24AM -0500, Len Conrad wrote: > > n 08/22/2009 10:57 PM Peter Maxwell wrote: > > > 2009/8/23 Len Conrad <LConrad@go2france.com>: > > > > I'm looking for something like bruteblock that logwatches (smtp, > > > > ssh, ftp, whatever) and inserts/removes TCP block rules into pf > > > > for x hours, so the protocol daemons are involved. If you're looking for a general-purpose solution, see /usr/ports/sysutils/grok. The FreeBSD man cgi doesn't seem to want to show the manpage, so here's an alternate link for more information: http://www.semicomplete.com/projects/grok/ > > > Before implementing something like this, I would urge caution: if > > > what you're asking was actually of any use, someone else would > > > probably have done it properly. I can't imagine how log entries > > > from an ftp server, say, are going to be related to your smtp > > > server security? If it's a simple connection management, then > > > max-src-conn/max-src-conn-rate might be a more robust solution. > > > > http://johan.fredin.info/openbsd/block_ssh_bruteforce.html explains > > how to use max-src-conn-rate and expiretable. > > > > # pkg_info -x expiretable > > Information for expiretable-0.6: > > > > Comment: > > Utility to remove entries from the pf(4) table based on their age > > I have no problem putting IPs into pf, it's expiring them that was > blocking me, but expiretable fixes that. >From pfctl(8): -T command [address ...] Specify the command (may be abbreviated) to apply to the table. Commands include: ... -T expire number Delete addresses which had their statistics cleared more than number seconds ago. For entries which have never had their statistics cleared, number refers to the time they were added to the table. IIRC, the expire command was added in 7.0 or 7.1. -- George
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090825151812.GA75010>