PF to Preventing SMTP Brute Force Attacks

[Matthew Seaman]

On 15/06/2012 17:17, Shiv. Nath wrote:
> Hi FreeBSD Gurus,
> 
> 
> i want to use PF to Preventing SMTP Brute Force Attacks. i need some help
> to understand correct syntax.
> 
> URL Explaining this: http://www.openbsd.org/faq/pf/filter.html#stateopts
> 
> 
> i expect the following behavior from the PF rule below:
> 
> Limit the absolute maximum number of states that this rule can create to 200
> 
> Enable source tracking; limit state creation based on states created by
> this rule only
> 
> Limit the maximum number of nodes that can simultaneously create state to 100
> 
> Limit the maximum number of simultaneous states per source IP to 3
> 
> Solution:
> int0="em0"
> trusted_tcp_ports="{22,25,443,465}"
> 
> pass in on $int0 proto tcp from any to any port $trusted_tcp_ports keep
> state max 200, source-track rule, max-src-nodes 100, max-src-states 3

Limiting yourself to 200 states won't protect you very much -- you tend
to get a whole series of attacks from the same IP, and that just uses
one state at a time.

Instead, look at the frequency with which an attacker tries to connect
to you.  Something like this:

table <bruteforce> persist

[...]

block in log quick from <bruteforce>

[...]

pass in on $ext_if proto tcp                     \
     from any to $ext_if port $trusted_tcp_ports \
     flags S/SA keep state                       \
     (max-src-conn-rate 3/300, overload <bruteforce> flush global)

Plus you'll need a cron job like this to clean up the bruteforce table,
otherwise it will just grow larger and larger:

*/12 * * * *	/sbin/pfctl -t ssh-bruteforce -T expire 604800 >/dev/null 2>&1

The end result of this is that if one IP tries to connect to you more
than 3 times in 5 minutes, they will get blacklisted.  I normally use
this just for ssh, so you might want to adjust the parameters
appropriately.  You should also implement a whitelist for IP ranges you
control or use frequently and that will never be used for bruteforce
attacks: it is quite easy to block yourself out with these sort of rules.

	Cheers,

	Matthew

-- 
Dr Matthew J Seaman MA, D.Phil.                   7 Priory Courtyard
                                                  Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey     Ramsgate
JID: matthew at infracaninophile.co.uk               Kent, CT11 9PW



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 267 bytes
Desc: OpenPGP digital signature
Url : http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20120615/8068b1c0/signature.pgp