> Although this doesn't answer your actual pf
> question, you might try
> using a tool called Grok
> (
http://www.semicomplete.com/projects/grok/).
> It's a pretty decent log watcher written in Perl,
> designed to do
> exactly this sort of thing. You define matches and
> reactions in its
> config file (match = "Illegal user %USERNAME% from
> %IP%"; reaction =
> "pfctl -t scanners -T add %IP%";).
>
> It does have a few quirks though. We've encountered
> problems with
> having multiple rules watching the same log. But,
> all in all, probably
> a better way to do what it looks like you want to
> do.
>
> - R.
>
> On 8/8/07, David Newman <dnewman@networktest.com>
> wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > On 6/27/07 10:39 PM, Daniel Ouellet wrote:
> > > Steve B wrote:
> > >> The rule I've had in my pf.conf file to catch
> and block forceful SSH
> > >> attempts no longer appears to be working. I see
> the entries in my
> > >> authlog,
> > >> but the IPs are no longer getting added to my
> table. I suspect I screwed
> > >> something up, but so far I am at a loss to see
> where. Could someone pass
> > >> another set of eyes over the relevant parts of
> my pf.conf?
> > >
> > > Put quickly as an example, but you can try:
> > >
> > > # Define some variable for clarity
> > > SSH_LIMIT="(max-src-conn-rate 3/30, overload
> <scanners> flush global)"
> > >
> > > ## SSH Hackers - blocked IPs
> > > table <scanners> persist file
> "/etc/tables/scanners"
> > >
> > > # Block ssh access to bad ssh scanner
> > > block drop in log quick on $ext_if inet proto
> tcp \
> > > from <scanners> to any port ssh
> > >
> > > # Allow quick valid traffic to ssh but log all
> attempts as well
> > > pass in log quick on $ext_if inet proto tcp from
> ! <scanners> \
> > > to $ext_if port ssh flags S/SA keep state \
> > > $SSH_LIMIT
> > >
> >
> > I've added something like this to pf.conf but it's
> only partially
> > successful. I would appreciate any clues as to why
> it's not blocking all
> > brute-force attempts.
> >
> > On an OBSD 4.1 box, here's what I added to pf.conf
> ($unpro is the
> > Internet-facing interface):
> >
> > #####
> >
> > # Define limit of ssh connection rates
> > SSH_LIMIT="(max-src-conn-rate 3/30, overload
> <scanners> flush global)"
> > # SSH scanners - blocked IPs
> > table <scanners> persist
> >
> > block drop in log quick on $unpro inet proto tcp \
> > from <scanners> to any port ssh
> >
> >
> > # Allow quick valid traffic to ssh but log all
> attempts as well
> > pass in log quick on $unpro inet proto tcp from !
> <scanners> \
> > to $unpro port ssh $SSH_LIMIT
> >
> > #####
> >
> > And it appears to be working, at least in part:
> >
> > dnewman@fw17 ~ 501$ sudo pfctl -t scanners -T show
> > 61.146.178.13
> > 61.189.145.103
> > 67.76.237.190
> > 161.200.144.108
> > 193.254.31.194
> >
> > #####
> >
> > But some hosts on the protected side of the
> firewall still report
> > brute-force ssh login attempts exceeding the 3/30
> rate:
> >
> > Aug 7 10:16:00 mail sshd[21608]: Invalid user
> trash from 201.18.81.8
> > Aug 7 10:16:08 mail sshd[21610]: Invalid user
> aaron from 201.18.81.8
> > Aug 7 10:16:11 mail sshd[21612]: Invalid user
> gt05 from 201.18.81.8
> > Aug 7 10:16:18 mail sshd[21614]: Invalid user
> william from 201.18.81.8
> > Aug 7 10:16:22 mail sshd[21616]: Invalid user
> stephanie from 201.18.81.8
> > Aug 7 10:16:59 mail sshd[21628]: Invalid user
> gary from 201.18.81.8
> > Aug 7 10:17:07 mail sshd[21632]: Invalid user
> guest from 201.18.81.8
> > Aug 7 10:17:11 mail sshd[21634]: Invalid user
> test from 201.18.81.8
> > Aug 7 10:17:17 mail sshd[21636]: Invalid user
> oracle from 201.18.81.8
> > Aug 7 10:19:24 mail sshd[21717]: Invalid user
> apache from 201.18.81.8
> > Aug 7 10:19:43 mail sshd[21723]: Invalid user lab
> from 201.18.81.8
> > Aug 7 10:19:55 mail sshd[21729]: Invalid user
> oracle from 201.18.81.8
> > Aug 7 10:20:00 mail sshd[21736]: Invalid user svn
> from 201.18.81.8
> > Aug 7 10:20:06 mail sshd[21745]: Invalid user
> iraf from 201.18.81.8
> > Aug 7 10:20:13 mail sshd[21747]: Invalid user
> swsoft from 201.18.81.8
> > Aug 7 10:20:18 mail sshd[21749]: Invalid user
> production from 201.18.81.8
> > Aug 7 10:20:23 mail sshd[21751]: Invalid user
> guest from 201.18.81.8
> > Aug 7 10:20:28 mail sshd[21753]: Invalid user
> gast from 201.18.81.8
> > Aug 7 10:20:34 mail sshd[21755]: Invalid user
> gast from 201.18.81.8
> > Aug 7 10:20:40 mail sshd[21762]: Invalid user
> oliver from 201.18.81.8
> > Aug 7 10:20:45 mail sshd[21767]: Invalid user
> sirsi from 201.18.81.8
> > Aug 7 10:20:50 mail sshd[21769]: Invalid user
> nagios from 201.18.81.8
> > Aug 7 10:20:55 mail sshd[21771]: Invalid user
> nagios from 201.18.81.8
> > Aug 7 10:20:59 mail sshd[21773]: Invalid user
> nagios from 201.18.81.8
> >
> > Thanks in advance for suggestions as to how to
> reduce these kind of
> > login attempts.
> >
> > dn
> >
>
