Date: Wed, 9 Feb 2011 01:01:35 +0100 From: "Helmut Schneider" <jumper99@gmx.de> To: "Vadym Chepkov" <vchepkov@gmail.com> Cc: freebsd-pf@FreeBSD.org Subject: Re: brutal SSH attacks Message-ID: <98689EFE59404E4B838E79071AABA8B4@charlieroot.de> In-Reply-To: <A6E48F78-AC10-40DE-9345-86D14CC4D3A1@gmail.com> References: <D04005BA-E154-4AE3-B14B-F9E6EF1269B0@gmail.com> <5A0B04327C334DA18745BFDBDBECE055@charlieroot.de> <A6E48F78-AC10-40DE-9345-86D14CC4D3A1@gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
>> Check your pflog. The ruleset itself seems fine (if it is complete and >> you did not forget to post >> a vital part). We also can assume that pf is enabled, can we? > > What should I be looking for in pflog? I can't find anything ssh related. > I posted full ruleset too. [...] > [root@castor /var/log]# for log in pflog.?.bz2 ; do bzcat > $log|tcpdump -r - port ssh ; done > reading from file -, link-type PFLOG (OpenBSD pflog file) > reading from file -, link-type PFLOG (OpenBSD pflog file) > reading from file -, link-type PFLOG (OpenBSD pflog file) > reading from file -, link-type PFLOG (OpenBSD pflog file) Well... > block drop in quick from <abusive_hosts> to any > pass quick inet proto tcp from any to 38.X.X.X port = ssh flags S/SA keep > state (source-track rule, max-src-conn 10, max-src-conn-rate 9/60, > overload <abusive_hosts> flush global, src.track 60) "block drop in quick log..." and "pass quick inet proto log" might be useful. BTW, what version of FreeBSD are you using? The machine isn't multi-homed, is it?
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?98689EFE59404E4B838E79071AABA8B4>