MESSAGE
| DATE | 2005-06-08 |
| FROM | Billy
|
| SUBJECT | Re: [NYLXS - HANGOUT] ssh help
|
Ruben Safir wrote:
> /*
> * SSHLOCKOUT_PF.C
> *
> * Written by Matthew Dillon
> * Modified to use PF tables by Scott Ullrich
> *
> * Use: pipe syslog auth output to this program. e.g. in /etc/syslog.conf:
> *
> * auth.info;authpriv.info /var/log/auth.log
> * auth.info;authpriv.info |exec /root/adm/sshlockout
> *
> * Detects failed ssh login and attempts to map out the originating IP
> * using PF's tables.
> *
> * setup a rule in your pf ruleset (near the top) similar to:
> * block in log quick from to any label "sshlockout"
> *
> * *VERY* simplistic. ipfw entries do not timeout, duplicate entries may
> * occur (though normally not since ssh won't see new connections from
> * the IP otherwise), there are no checks made for local IPs or nets,
> * or for prior successful logins, etc.
> */
Is there a question or statement in here somewhere? Some context?
|
|
