something like bruteblock for pf?

[George Davidovich]

On Sun, Aug 23, 2009 at 10:49:24AM -0500, Len Conrad wrote:
> > n 08/22/2009 10:57 PM Peter Maxwell wrote:
> > > 2009/8/23 Len Conrad <LConrad at go2france.com>:
> > > > I'm looking for something like bruteblock that logwatches (smtp,
> > > > ssh, ftp, whatever) and inserts/removes TCP block rules into pf
> > > > for x hours, so the protocol daemons are involved.

If you're looking for a general-purpose solution, see
/usr/ports/sysutils/grok.  The FreeBSD man cgi doesn't seem to want to
show the manpage, so here's an alternate link for more information:

http://www.semicomplete.com/projects/grok/

> > > Before implementing something like this, I would urge caution: if
> > > what you're asking was actually of any use, someone else would
> > > probably have done it properly.   I can't imagine how log entries
> > > from an ftp server, say, are going to be related to your smtp
> > > server security?  If it's a simple connection management, then
> > > max-src-conn/max-src-conn-rate might be a more robust solution.
> > 
> > http://johan.fredin.info/openbsd/block_ssh_bruteforce.html explains
> > how to use max-src-conn-rate and expiretable.
> > 
> > # pkg_info -x expiretable
> > Information for expiretable-0.6:
> > 
> > Comment:
> > Utility to remove entries from the pf(4) table based on their age
> 
> I have no problem putting IPs into pf, it's expiring them that was
> blocking me, but expiretable fixes that.

>From pfctl(8):

  -T command [address ...]
       Specify the command (may be abbreviated) to apply to the
       table.  Commands include:
       ...          
       -T expire number
            Delete addresses which had their statistics cleared more
            than number seconds ago.  For entries which have never
            had their statistics cleared, number refers to the time
            they were added to the table.

IIRC, the expire command was added in 7.0 or 7.1.

-- 
George