MESSAGE
| DATE | 2005-06-08 |
| FROM | Ruben Safir
|
| SUBJECT | Re: [NYLXS - HANGOUT] ssh help
|
There has been a number of attacks on SSHD, which I've expereinced as
well. In thoery, this is code for the firewall to block repeated
offenders from the port.
Reuvain
On Wed, 2005-06-08 at 14:32, Billy wrote:
> Ruben Safir wrote:
> > /*
> > * SSHLOCKOUT_PF.C
> > *
> > * Written by Matthew Dillon
> > * Modified to use PF tables by Scott Ullrich
> > *
> > * Use: pipe syslog auth output to this program. e.g. in /etc/syslog.conf:
> > *
> > * auth.info;authpriv.info /var/log/auth.log
> > * auth.info;authpriv.info |exec /root/adm/sshlockout
> > *
> > * Detects failed ssh login and attempts to map out the originating IP
> > * using PF's tables.
> > *
> > * setup a rule in your pf ruleset (near the top) similar to:
> > * block in log quick from to any label "sshlockout"
> > *
> > * *VERY* simplistic. ipfw entries do not timeout, duplicate entries may
> > * occur (though normally not since ssh won't see new connections from
> > * the IP otherwise), there are no checks made for local IPs or nets,
> > * or for prior successful logins, etc.
> > */
>
>
>
>
> Is there a question or statement in here somewhere? Some context?
|
|
