Date: Thu, 21 Aug 2008 18:22:14 -0400 From: Mikhail Teterin <mi+mill@aldan.algebra.com> To: Ross Wheeler <rossw@albury.net.au> Cc: freebsd-security@freebsd.org, Jeremy Chadwick <koitsu@freebsd.org>, freebsd-stable@freebsd.org Subject: Re: machine hangs on occasion - correlated with ssh break-in attempts Message-ID: <48ADEA96.70203@aldan.algebra.com> In-Reply-To: <20080822074020.G32956@ali-syd-1.albury.net.au> References: <48ADA81E.7090106@aldan.algebra.com> <20080821200309.GA19634@eos.sc1.parodius.com> <48ADCFD5.8020902@aldan.algebra.com> <20080822074020.G32956@ali-syd-1.albury.net.au>
next in thread | previous in thread | raw e-mail | index | archive | help
Ross Wheeler ΞΑΠΙΣΑΧ(ΜΑ):
> I overcame these conflicting requirements with a 2-step process. They
> "authorised" user first browsed to a website which asked their
> username and password. When entered correctly, it opened a hole in the
> firewall to allow that IP to their network. A timer ran every 15
> minutes to close the hole (but was over-ridden by the web page which
> kept refreshing every 10 mins). The last part may not be necessary for
> you, but this may be a possible workaround for your traveling access.
> Leave a default of deny any except from trusted, fixed hosts, and add
> transient access as required.
This approach (or port-knocking of some sort) is good, but I'm not that
worried about the sshd itself -- and the /detected/ attacks against it.
It is the /undetected/ attacks against other services (such as apache),
that worry me, and locking-out a rogue IP-address /completely/ is what
I'd like to do. So your method would not work for me -- reaching the
web-page (to allow myself a way back in) will be just as impossible as
reaching the ssh-port... Thanks. Yours,
-mi
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?48ADEA96.70203>