Hi, I'm pretty new to FreeBSD, but when I saw how neatly it supported file-backed tables for IP blocking I knew I'd finally want to build a bruteforce blocking script that I'd long wanted to create on Linux.
This script is loosely based on the perl script for the same purpose from http://home.earthlink.net/~valiantsoul/pf.html . My script, in contrast to the above, runs as a daemon and is completely self contained other than the blacklist file. Of course it's up to the user to create the bruteforce table in pf and to do something useful with it, but once that's done just running the bruteforce.py daemon will take care of the rest. I've attached the script and my pf.conf. The only other requirements other than python are py-fam and (of course) a configured fam. I'd love to hear other people's feedback on this approach of using FAM + auth.log to implement this and/or to hear of other superior approaches to achieving this result. Thanks for reading, --Brandon
table <bruteforce> persist file "/var/db/blacklist" table <safe> persist file "/var/db/friendlist" block in all pass in on nfe0 proto tcp from any to any port 22 keep state pass in on nfe0 proto tcp from any to any port 80 keep state pass in on nfe0 proto tcp from any to any port 443 keep state pass in on nfe0 proto tcp from any to any port 25 keep state pass in on nfe0 proto tcp from any to any port 465 keep state pass in on nfe0 proto tcp from any to any port 993 keep state pass in on nfe0 proto udp from any to any port 53 pass in on nfe0 proto tcp from any to any port 53 keep state pass in on nfe0 proto udp from any to any port 123 pass in on nfe0 proto icmp block from <bruteforce> pass from <safe> pass on lo0 pass out all keep state
_______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
