Date: Tue, 22 Nov 2005 11:35:29 -0800 (PST) From: Roger Marquis <marquis@roble.com> To: Marian Hettwer <MH@kernel32.de> Cc: freebsd-security@freebsd.org Subject: Re: Need urgent help regarding security Message-ID: <20051122112344.U18517@roble.com> In-Reply-To: <43836D25.5000101@kernel32.de> References: <20051122120112.9D83516A423@hub.freebsd.org> <20051122075050.I81101@roble.com> <43836D25.5000101@kernel32.de>
next in thread | previous in thread | raw e-mail | index | archive | help
>> 2) running an sshd IDS that A) tests for '(for invalid user|Failed >> password for)', B) blacholes source hosts 'ipfw add deny ...', and >> C) alerts sysadmin or operations personnel, >> >Be careful with adding ip addresses to deny via a packet filter. >If an attacker uses spoofed IP adresses, you may produce yourself >easily a denial of service attack. Not sure I agree with the easily part. TCP transport plus SSH protocol spoofing is not a vector that normally needs to be secured beyond what is already done in the kernel and router. That's not to say such spoofing cannot be done, just that it is rare and would require a compromised router or localnet host at a minimum. > Say I used the IP address of your default gateway. If you > don't check that and just add a deny rule... well... bad luck ;-) I would hope that your router doesn't accept packets with its own source address. But this does bring up a good point i.e, that no IDS should be operated without a well thought-out whitelist. -- Roger Marquis Roble Systems Consulting http://www.roble.com/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20051122112344.U18517>