Re: inbound ssh ceased on 4 servers at same time

From: Marcin Jessa (lists_at_yazzy.org)
Date: 06/09/05

  • Next message: ovidiue_at_unixware.ro: "(no subject)" 
    Date: Thu, 9 Jun 2005 16:35:04 +0200
To: john@day-light.com

    Hi.

    I know of a patch which locks out ssh users after X unsecessfull attempts (with possibility of whitelisting). I think the guys from pfsense use it or at least have that patch somewhere.
    I thought OpenBSD had an option in sshd or/and pf for that as well.
    Thanks for the answer John.

    Cheers,
    Marcin.

    On Thu, 9 Jun 2005 08:56:33 -0500
    "John Brooks" <john@day-light.com> wrote:

    > All traffic must pass thru the firewall in order to reach the
    > inside network. There are no nat redirect rules for port 22, so
    > all port 22 traffic is intercepted by the firewall. The only
    > way to reach interior hosts is to specifically log onto the firewall
    > and from the firewall ssh into the interior hosts.
    >
    > On some of my networks the firewall will only accept traffic from
    > specific hosts, dropping all others. (sshd is running on all hosts)
    > All of my firewalls are running hardened versions of OpenBSD. All
    > of the servers behind the firewalls are running FreeBSD.
    >
    > --
    > John Brooks
    > john@day-light.com
    >
    > > -----Original Message-----
    > > From: Marcin Jessa [mailto:lists@yazzy.org]
    > > Sent: Thursday, June 09, 2005 8:39 AM
    > > To: john@day-light.com
    > > Cc: freebsd-isp@freebsd.org
    > > Subject: Re: inbound ssh ceased on 4 servers at same time
    > >
    > >
    > > Hi John, guys.
    > >
    > > On Sat, 4 Jun 2005 13:14:28 -0500
    > > "John Brooks" <john@day-light.com> wrote:
    > >
    > > > Thanks, sounds good to do on the outward facing firewall. These
    > > > four freebsd boxes are protected behind an openbsd firewall so
    > > > none of the brute-force sshd attacks have ever reached them.
    > >
    > > How do you filter those brute-force attacks?
    > > Do you check existence of users on the actual server running sshd ?
    > > I get hundreds of those attacks every day.
    > >
    > > Cheers,
    > > Marcin Jessa.
    > >
    > _______________________________________________
    > freebsd-isp@freebsd.org mailing list
    > http://lists.freebsd.org/mailman/listinfo/freebsd-isp
    > To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"
    _______________________________________________
    freebsd-isp@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-isp
    To unsubscribe, send any mail to "freebsd-isp-unsubscribe@freebsd.org"

  • Next message: ovidiue_at_unixware.ro: "(no subject)"

    Relevant Pages

    • Re: problems with KB951746
      ... Blocking legitimate IP addresses responding on ports the ... using the net will cause the firewall to block IPs more rapidly. ... I doubt the patch, or SBS, is the problem here. ... tried different forwarders, different DNS servers, and root hints only. ...
      (microsoft.public.windows.server.sbs)
    • Re: problems with KB951746
      ... Blocking legitimate IP addresses responding on ports the firewall doesn't expect will cause problems. ... What I suspect is happening is that the patch is doing what it is supposed to do. ... It is also possible, but less likely, that your ISP's DNS servers are misconfigured and are unable to reply on odd source ports. ...
      (microsoft.public.windows.server.sbs)
    • RE: Purging Blaster.worm
      ... hits to go, "Man, I thought our firewall would stop it." ... will just keep changing ports ... to freaking patch the systems. ... store/shop, and yes, the Symantec removal tool works great. ...
      (Security-Basics)
    • WORM virus shutting down my computer
      ... click the little box to enable your Firewall. ... you can download the Patch. ... Then go on the internet: ... Click on download on the right- takes about five to six ...
      (microsoft.public.windowsxp.security_admin)
    • Re: [fw-wiz] terminal services
      ... >> pointing out the danger of opening extra holes in your firewall. ... >that a VPN is a hole in the firewall, albeit generally a mitigated hole, ... >people didn't patch their machines. ...
      (Firewall-Wizards)