Date: Thu, 1 Oct 2015 03:58:32 +1000 (EST) From: Ian Smith <smithi@nimnet.asn.au> To: Nino J <nino80@gmail.com> Cc: Alexandre <axelbsd@ymail.com>, freebsd-questions@freebsd.org Subject: Re: SSHguard & IPFW Message-ID: <20151001033001.R67283@sola.nimnet.asn.au> In-Reply-To: <mailman.98.1443614402.37653.freebsd-questions@freebsd.org> References: <mailman.98.1443614402.37653.freebsd-questions@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
In freebsd-questions Digest, Vol 591, Issue 2, Message: 14 On Wed, 30 Sep 2015 09:41:55 +0200 Nino J <nino80@gmail.com> wrote: > On Tue, Sep 29, 2015 at 4:24 PM, Alexandre <axelbsd@ymail.com> wrote: > > > > > >> About the blocking rules reservation in IPFW (from rule 55000 to > > >> 55050), anyone experienced yet full use of these rules? > > >> By default, fifteen addresses can be blocked together. But how SSHGUARD > > >> works in this case for the newest one (51th)? > > >> > > >> Thank you in advance for your clarifications. > > >> Alexandre > > > > To answer your second question, IPFW has no problem using the same rule > number for multiple rules. Thus sshguard is not limited to 50 addresses. > > Also, next version of sshguard won't use IPFW rules, but rather an IPFW > table to insert IP addresses to be blocked. Thus it will only need a single > deny rule. That's so much smarter than a fixed block of rule numbers, and you can put your table lookup or action rule/s whereever you want in rulesets. Moreover, utilities could add a 32 bit value to table entries such as a timestamp (for later expiry) or a skipto address for classification of different types of detected behaviours, whatever .. > I'm currently using development version of sshguard which uses IPFW table > and it works fine for me. I'm more paranoid and only allow addresses in a table to access sshd's port, with a couple of roaming users who need to check mail to update their IP before login .. but this is great news for sshguard users. cheers, Ian
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20151001033001.R67283>