From owner-freebsd-questions@FreeBSD.ORG Fri Mar 5 12:54:47 2010 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A0FE4106566C for ; Fri, 5 Mar 2010 12:54:47 +0000 (UTC) (envelope-from john@starfire.mn.org) Received: from elwood.starfire.mn.org (starfire.skypoint.net [173.8.102.29]) by mx1.freebsd.org (Postfix) with ESMTP id 54C038FC17 for ; Fri, 5 Mar 2010 12:54:46 +0000 (UTC) Received: from elwood.starfire.mn.org (john@localhost [127.0.0.1]) by elwood.starfire.mn.org (8.14.3/8.14.3) with ESMTP id o25Cskih015085 for ; Fri, 5 Mar 2010 06:54:46 -0600 (CST) (envelope-from john@elwood.starfire.mn.org) Received: (from john@localhost) by elwood.starfire.mn.org (8.14.3/8.14.3/Submit) id o25CskbL015084 for freebsd-questions@freebsd.org; Fri, 5 Mar 2010 06:54:46 -0600 (CST) (envelope-from john) Date: Fri, 5 Mar 2010 06:54:46 -0600 From: John To: freebsd-questions@freebsd.org Message-ID: <20100305125446.GA14774@elwood.starfire.mn.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.4.2.3i Subject: Thousands of ssh probes X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Mar 2010 12:54:47 -0000 My nightly security logs have thousands upon thousands of ssh probes in them. One day, over 6500. This is enough that I can actually "feel" it in my network performance. Other than changing ssh to a non-standard port - is there a way to deal with these? Every day, they originate from several different IP addresses, so I can't just put in a static firewall rule. Is there a way to get ssh to quit responding to a port or a way to generate a dynamic pf rule in cases like this? -- John Lind john@starfire.MN.ORG