bruteforce not restarting pf?
Gerard Seibert
gerard at seibercom.net
Tue Nov 8 17:40:22 GMT 2005
On Tuesday, November 08, 2005 12:02:02 PM, "Dave" <dmehler26 at woh.rr.com>
Subject: bruteforce not restarting pf?
Wrote these words of wisdom:
> Hello,
> I've got a machine running 5.4, offering ssh services and running
> bruteforce. In my daily security log emails i am seeing entries like:
>
> Nov 7 07:06:55 zeus sshd[24747]: Failed password for illegal user miha from
> 163.13.111.172 port 56265 ssh2
> Nov 7 07:06:58 zeus sshd[24749]: Failed password for illegal user miha from
> 163.13.111.172 port 56319 ssh2
> Nov 7 07:07:01 zeus sshd[24751]: Failed password for root from
> 163.13.111.172 port 56376 ssh2
> Nov 7 07:07:03 zeus sshd[24753]: Failed password for root from
> 163.13.111.172 port 56418 ssh2
> Nov 7 07:07:05 zeus sshd[24757]: Failed password for illegal user simon
> from 163.13.111.172 port 56461 ssh2
> Nov 7 07:07:08 zeus sshd[24759]: Failed password for illegal user simon
> from 163.13.111.172 port 56504 ssh2
> Nov 7 07:07:10 zeus sshd[24761]: Failed password for root from
> 163.13.111.172 port 56543 ssh2
> Nov 7 07:07:12 zeus sshd[24763]: Failed password for root from
> 163.13.111.172 port 56589
> ...
>
> I know these are automated atempts at entry but i thought bruteforce was
> suppose to stop these. In my auth.log i do see the IP being added, but
> connections are still allowed. Here's the snipet:
>
> Nov 7 06:54:52 zeus sshd[24687]: fatal: Timeout before authentication for
> 163.13.111.172
> Nov 7 07:06:55 zeus sshd[24747]: Illegal user miha from 163.13.111.172
> Nov 7 07:06:55 zeus sshd[24747]: Failed password for illegal user miha from
> 163.13.111.172 port 56265 ssh2
> 163.13.111.172 was logged with total count of 1.
> Nov 7 07:06:58 zeus sshd[24749]: Illegal user miha from 163.13.111.172
> Nov 7 07:06:58 zeus sshd[24749]: Failed password for illegal user miha from
> 163.13.111.172 port 56319 ssh2
> 163.13.111.172 was logged with total count of 2.
> Nov 7 07:07:01 zeus sshd[24751]: Failed password for root from
> 163.13.111.172 port 56376 ssh2
> 163.13.111.172 was logged with total count of 3.
> Nov 7 07:07:03 zeus sshd[24753]: Failed password for root from
> 163.13.111.172 port 56418 ssh2
> IP 163.13.111.172 reached the maximum number of failed attempts!!!
> Adding IP to the firewall...
> Nov 7 07:07:05 zeus sshd[24757]: Illegal user simon from 163.13.111.172
> Nov 7 07:07:05 zeus sshd[24757]: Failed password for illegal user simon
> from 163.13.111.172 port 56461 ssh2
> Nov 7 07:07:08 zeus sshd[24759]: Illegal user simon from 163.13.111.172
> Nov 7 07:07:08 zeus sshd[24759]: Failed password for illegal user simon
> from 163.13.111.172 port 56504 ssh2
> Nov 7 07:07:10 zeus sshd[24761]: Failed password for root from
> 163.13.111.172 port 56543 ssh2
>
> Checking my bruteforce table ;i see 163.13.111.172/32 in it, so it was
> added, but i don't get why future connections were permitted unless pf was
> not restarted or informed about the updated table. In my pf.conf file i
> have:
>
> table <bruteforce> persist file "/etc/bruteforce"
> set block-policy drop
> block in log quick on $ext_if inet proto tcp from <bruteforce> to any port
> ssh
>
> Any help appreciated.
> Thanks.
> Dave.
>
***** REPLY SEPARATOR *****
On 10/11/2005 5:29:42 PM, Gerard Replied:
You might want to check out this URL:
http://danger.rulez.sk/projects/bruteforceblocker/
Perhaps you might be able to glom something of value there.
--
Gerard Seibert
gerard at seibercom.net
A: Because it reverses the natural flow of a dialog.
Q: Why is top posting undesirable when replying?
TOPIC: Posting Etiquette
More information about the freebsd-questions
mailing list