Thousands of ssh probes

[Matthew Seaman]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 05/03/2010 16:54:50, Matthias Fechner wrote:
> Hi,
> 
> Am 05.03.10 17:01, schrieb Matthew Seaman:
>> table <ssh-bruteforce> persist
>> [...near the top of the rules section...]
>> block drop in log quick on $ext_if from<ssh-bruteforce>
>>
>> [...later in the rules section...]
>> pass in on $ext_if proto tcp      \
>>       from any to $ext_if port ssh \
>>       flags S/SA keep state        \
>>       (max-src-conn-rate 3/30, overload<ssh-bruteforce>  flush global)
>>    
> 
> that is dangarous, if you use subversion over ssh you will sometimes get
> more then 10 requests in 30 seconds.
> That means you will also block users they are allowed to connect.

Yes.  Almost all of the time I use this I've also had a ssh-whitelist
table -- addresses that will never be blocked in this way.  Like this:

table <ssh-bruteforce> persist
table <ssh-whitelist> const { \
    81.187.76.160/29          \
    2001:8b0:151:1::/64       \
} persist

block drop in log quick on $ext_if from <ssh-bruteforce>

pass in on $ext_if proto tcp                 \
    from <ssh-whitelist> to $ext_if port ssh \
    flags S/SA keep state

pass in on $ext_if proto tcp                  \
    from !<ssh-whitelist> to $ext_if port ssh \
    flags S/SA keep state                     \
    (max-src-conn-rate 3/30, overload <ssh-bruteforce> flush global)

	Cheers,

	Matthew
- -- 
Dr Matthew J Seaman MA, D.Phil.                   7 Priory Courtyard
                                                  Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey     Ramsgate
                                                  Kent, CT11 9PW
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.14 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEUEARECAAYFAkuROYMACgkQ8Mjk52CukIwA7ACfcngE3ZsQmRAoTY7sW9aqXfLv
IW8Al1Pl4OaGfWbytHAYrfqnWYpNs40=
=Yg12
-----END PGP SIGNATURE-----