machine hangs on occasion - correlated with ssh break-in attempts

Mikhail Teterin mi+mill at aldan.algebra.com
Thu Aug 21 22:22:21 UTC 2008


Ross Wheeler написав(ла):
> I overcame these conflicting requirements with a 2-step process. They 
> "authorised" user first browsed to a website which asked their 
> username and password. When entered correctly, it opened a hole in the 
> firewall to allow that IP to their network. A timer ran every 15 
> minutes to close the hole (but was over-ridden by the web page which 
> kept refreshing every 10 mins). The last part may not be necessary for 
> you, but this may be a possible workaround for your traveling access. 
> Leave a default of deny any except from trusted, fixed hosts, and add 
> transient access as required.
This approach (or port-knocking of some sort) is good, but I'm not that 
worried about the sshd itself -- and the /detected/ attacks against it. 
It is the /undetected/ attacks against other services (such as apache), 
that worry me, and locking-out a rogue IP-address /completely/ is what 
I'd like to do. So your method would not work for me -- reaching the 
web-page (to allow myself a way back in) will be just as impossible as 
reaching the ssh-port... Thanks. Yours,

    -mi



More information about the freebsd-stable mailing list