-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 05/03/2010 16:54:50, Matthias Fechner wrote: > Hi, > > Am 05.03.10 17:01, schrieb Matthew Seaman: >> table <ssh-bruteforce> persist >> [...near the top of the rules section...] >> block drop in log quick on $ext_if from<ssh-bruteforce> >> >> [...later in the rules section...] >> pass in on $ext_if proto tcp \ >> from any to $ext_if port ssh \ >> flags S/SA keep state \ >> (max-src-conn-rate 3/30, overload<ssh-bruteforce> flush global) >> > > that is dangarous, if you use subversion over ssh you will sometimes get > more then 10 requests in 30 seconds. > That means you will also block users they are allowed to connect.
Yes. Almost all of the time I use this I've also had a ssh-whitelist table -- addresses that will never be blocked in this way. Like this: table <ssh-bruteforce> persist table <ssh-whitelist> const { \ 81.187.76.160/29 \ 2001:8b0:151:1::/64 \ } persist block drop in log quick on $ext_if from <ssh-bruteforce> pass in on $ext_if proto tcp \ from <ssh-whitelist> to $ext_if port ssh \ flags S/SA keep state pass in on $ext_if proto tcp \ from !<ssh-whitelist> to $ext_if port ssh \ flags S/SA keep state \ (max-src-conn-rate 3/30, overload <ssh-bruteforce> flush global) Cheers, Matthew - -- Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard Flat 3 PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate Kent, CT11 9PW -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEUEARECAAYFAkuROYMACgkQ8Mjk52CukIwA7ACfcngE3ZsQmRAoTY7sW9aqXfLv IW8Al1Pl4OaGfWbytHAYrfqnWYpNs40= =Yg12 -----END PGP SIGNATURE----- _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"