login
Login / Register
Header Space

 
 

Home » Mailing list archives » openbsd-misc » 2007 » August » 13

Re: SSH brute force attacks no longer being caught by PF rule

Previous thread: Top/uptime seems high by Edwards, David (JTS) on Monday, August 13, 2007 - 2:24 am. (10 messages)

Next thread: OpenCON 2007 // Call for Sponsors by Ed on Monday, August 13, 2007 - 10:25 am. (1 message)
[view original message]
From: no@spam@mgedv.net <nospam@...>
To: Stuart Henderson <stu@...>, OpenBSD <misc@...>
Subject: Re: SSH brute force attacks no longer being caught by PF rule
Date: Monday, August 13, 2007 - 7:51 am

----- Original Message ----- 
From: "Stuart Henderson" &lt;stu@spacehopper.org&gt;
To: "OpenBSD" &lt;misc@openbsd.org&gt;
Sent: Monday, August 13, 2007 1:30 PM
Subject: Re: [misc] SSH brute force attacks no longer being caught by PF 


maybe somewhat off-topic, but:
why don't you just switch your ssh port to a different one.
we've been running with this configuration since years and
a log examination of the ssh-logs and connection logs from
the firewall shows that there was not even 1 (!) connect to
the ssh-port from "bad" IPs.
[view original message]
From: Stuart Henderson <stu@...>
To: no@spam@mgedv.net <nospam@...>
Cc: OpenBSD <misc@...>
Subject: Re: SSH brute force attacks no longer being caught by PF rule
Date: Monday, August 13, 2007 - 8:25 am

In my case, because it annoys me, and max-src-conn-rate doesn't.
[view original message]
From: David Newman <dnewman@...>
To: OpenBSD <misc@...>
Subject: Re: SSH brute force attacks no longer being caught by PF rule
Date: Monday, August 13, 2007 - 8:39 pm

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


I concur, and would add that this fails the security-by-obscurity test.

In any event, max-src-conn-rate and max-src-conn are now keeping the
skiddies (or whomever) at bay. Thanks all who responded.

dn
iD8DBQFGwPm/yPxGVjntI4IRAib4AKCEn0kDDWy0qr9MjMcYVlRKCwVFRACgyB0i
8gwsRtzc+M0W/RwHLYNbXm0=
=56Ag
-----END PGP SIGNATURE-----
Previous thread: Top/uptime seems high by Edwards, David (JTS) on Monday, August 13, 2007 - 2:24 am. (10 messages)

Next thread: OpenCON 2007 // Call for Sponsors by Ed on Monday, August 13, 2007 - 10:25 am. (1 message)

Mail archive search
Enter your search terms.
Optionally limit your search to a specific mailing list.
advanced
Recent Tags
more tags
Colocation donated by:
Who's online
There are currently 5 users and 1287 guests online.

Online users

Syndicate
Syndicate content
© 2007 KernelTrap.  |  Powered by Drupal.  |  Legal statement.
speck-geostationary