From owner-freebsd-questions@FreeBSD.ORG  Tue May 24 02:36:20 2005
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
X-Original-To: freebsd-questions@freebsd.org
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 123F016A41C
	for <freebsd-questions@freebsd.org>;
	Tue, 24 May 2005 02:36:20 +0000 (GMT)
	(envelope-from lists@natserv.com)
Received: from mail1.acecape.com (mail1.acecape.com [66.114.74.12])
	by mx1.FreeBSD.org (Postfix) with ESMTP id A282243D1F
	for <freebsd-questions@freebsd.org>;
	Tue, 24 May 2005 02:36:19 +0000 (GMT)
	(envelope-from lists@natserv.com)
Received: from zoraida.natserv.net (p65-147.acedsl.com [66.114.65.147])
	by mail1.acecape.com (8.12.11/8.12.11) with ESMTP id j4O2a0bb018396;
	Mon, 23 May 2005 22:36:00 -0400
Date: Mon, 23 May 2005 22:36:00 -0400 (EDT)
From: Francisco Reyes <lists@natserv.com>
X-X-Sender: fran@zoraida.natserv.net
To: fbsd_user <fbsd_user@a1poweruser.com>
In-Reply-To: <MIEPLLIBMLEEABPDBIEGEEIFHFAA.fbsd_user@a1poweruser.com>
Message-ID: <20050523223025.O46920@zoraida.natserv.net>
References: <MIEPLLIBMLEEABPDBIEGEEIFHFAA.fbsd_user@a1poweruser.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: freebsd-questions@freebsd.org
Subject: RE: securing SSH, FBSD systems
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 24 May 2005 02:36:20 -0000

On Mon, 23 May 2005, fbsd_user wrote:

> These manual routes are stored in memory.
> Can you tell how much memory is used by your 300+ list?

I don't know, but it probably is comparable to what it would take to 
put them in the firewall rules.

> Is there some command to display these user added route list?

netstat -nr|grep 127

> Is the <hacker ip> a single IP address or can you say 62.0.0.0/8?

The way I use  it is a single IP, but a quick read of the man page it 
seems you can also indicate blocks. Man route and search for the phrase 
"For example"

Also see my other poston this thread. In particular the URL to the small 
scripts I use. They could use lots of improvement, but they may be a good 
start for someone interested in automating the process.

I believe there are also programs which can monitor the logs and 
automatically perform actions, but those are likely harder to learn and 
setup.