Date: Tue, 18 Apr 2023 22:47:01 -0700 From: Doug Hardie <bc979@lafn.org> To: Michael Grimm <trashcan@ellael.org>, questions@freebsd.org Subject: Re: Blacklistd Issues - Problem Identified Message-ID: <73E5F450-0347-45A0-A2F8-DB3367CE9DCA@sermon-archive.info> In-Reply-To: <6BD45EAE-D626-4B16-8C24-197FFE34E601@ellael.org> References: <C632EC86-6745-42F9-A5EE-FE604C7A8599@sermon-archive.info> <8B1C1DCE-75CA-4CE9-A589-329519FB792E@sermon-archive.info> <4E4A4B99-D8DF-4C5C-9700-C56F354A9991@sermon-archive.info> <24171551-4181-49C8-B1DE-2C3D9A00DC4C@sermon-archive.info> <6BD45EAE-D626-4B16-8C24-197FFE34E601@ellael.org>
next in thread | previous in thread | raw e-mail | index | archive | help
> On Apr 18, 2023, at 03:08, Michael Grimm <trashcan@ellael.org> wrote: >=20 > Doug Hardie <bc979@lafn.org> wrote: >>> On Apr 17, 2023, at 16:42, Doug Hardie <bc979@lafn.org> wrote: >>>=20 >>> After digging through the code for blacklistd I find that postfix = and my web server call blacklistd with a type of 1 (BL_ADD) and sure = enough, blacklistd calls the helper to add the pf rule. However. sshd = calls with type 4 (BL_BADUSER) and there is a note in the handling of = that type that says "Ignore for now". And that it does, i.e., nothing. = So the problem is in sshd using a type that is not implemented, or in = backlistd which does not implement the BADUSER type. I wonder if = Release 13.2 will fix either of those. >>>=20 >>=20 >> Basically the BADUSER call from sshd is moved to the ADD function. = So instead of what was supposed to be an immediate shutdown on one bad = authentication regardless of the conf settings, it now follows the = config settings rule. I am not convinced that sshd should use the = BADUSER call. It causes a single typo to lock you out. It seems to me = that it should use the ADD function so the admin gets to chose the = proper number of bad authentications before lockout. >>=20 >> I'd submit a PR on this, but all the PRs I have submitted have been = left to wither on the vine. >>=20 >> -- Doug >=20 > Please do so. This has been discussed before [1], and I will = definitely support your patch or a solution that makes BADUSER = configurable. >=20 > I am currently testing your patch. >=20 > [1] = https://lists.freebsd.org/archives/freebsd-questions/2023-March/003056.htm= l I submitted a PR. It is 270928=20 -- Doug
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?73E5F450-0347-45A0-A2F8-DB3367CE9DCA>