Hey all,
I have the following rule set up in ipfw to limit the exposure of bad php
scripts and trojans that try to send mail directly.
allow tcp from any to any dst-port 25 uid root
deny log tcp from any to any dst-port 25 out
However, the log messages I get look like this:
Sep 8 13:21:11 <security.info> prime kernel: ipfw: 610 Deny TCP
72.9.101.130:58117 209.85.133.114:25 out via em0
Sep 8 13:21:16 <security.info> prime kernel: ipfw: 610 Deny TCP
72.9.101.130:56672 202.12.31.144:25 out via em0
Sep 8 13:21:16 <security.info> prime kernel: ipfw: 610 Deny TCP
72.9.101.130:58131 209.85.133.27:25 out via em0
Sep 8 13:21:28 <security.info> prime kernel: ipfw: 610 Deny TCP
72.9.101.130:58117 209.85.133.114:25 out via em0
Sep 8 13:21:32 <security.info> prime kernel: ipfw: 610 Deny TCP
72.9.101.130:58131 209.85.133.27:25 out via em0
Sep 8 13:22:45 <security.info> prime kernel: ipfw: 610 Deny TCP
72.9.101.130:65313 64.202.166.12:25 out via em0
Sep 8 13:22:45 <security.info> prime kernel: ipfw: 610 Deny TCP
72.9.101.130:65313 64.202.166.12:25 out via em0
Sep 8 13:22:46 <security.info> prime kernel: ipfw: 610 Deny TCP
72.9.101.130:65313 64.202.166.12:25 out via em0
Sep 8 13:22:49 <security.info> prime kernel: ipfw: 610 Deny TCP
72.9.101.130:65313 64.202.166.12:25 out via em0
Which is to say, they don't include the UID -- and I have several hundred
sites, each with its own UID.
Yes, I could go ahead and set up a thousand "deny" rules, one for each UID
-- but being able to log this info (since it IS being checked) would be
great.
Thoughts?
-Dan Mahoney
--
--------Dan Mahoney--------
Techie, Sysadmin, WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144 AIM: LarpGM
Site: http://www.gushi.org
---------------------------
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
