Блог FreeBSD

radio# whereis bruteblock
bruteblock: /usr/ports/security/bruteblock
radio# cd /usr/ports/security/bruteblock
radio# make install clean

===>  CONFIGURATION NOTE:
 
  Configuration of the bruteblock is done via configuration files
  located at /usr/local/etc/bruteblock/
 
  To run the script, append following lines to /etc/syslog.conf:
 
!*
auth.info;authpriv.info                         |exec /usr/local/sbin/bruteblock -f /usr/local/etc/bruteblock/ssh.conf
 
  and restart syslogd.
 
  Also you should add ipfw2 table and the corresponding deny rule.
  For example,
 
# ipfw add deny ip from table(1) to any  
 
  Next, you'll want to setup periodical cleanup of ipfw2 table.  Add following
  lines to /etc/rc.conf:
 
     bruteblockd_enable="YES"
     bruteblockd_table="1"
     bruteblockd_flags="-s 5"
 
  and start bruteblockd: /usr/local/etc/rc.d/bruteblockd.sh start
 
See bruteblock(8) for more detailts.

auth.info;authpriv.info                         /var/log/auth.log

auth.info;authpriv.info                         |exec /usr/local/sbin/bruteblock -f /usr/local/etc/bruteblock/ssh.conf

radio# /etc/rc.d/syslogd restart
Stopping syslogd.
Starting syslogd.

#!/bin/sh
 
fwcmd="/sbin/ipfw"            # бинарник IPFW
 
# сбрасываем все правила
${fwcmd} -f flush
# сбрасываем все pipe
#${fwcmd} -f pipe flush
# сбрасываем очереди
#${fwcmd} -f queue flush
 
#берем адреса из таблицы table 1 и блокируем их
${fwcmd} add 100 deny ip from table\(1\) to any
 
${fwcmd} add 200 pass all from any to any via lo0
${fwcmd} add 300 deny all from any to 127.0.0.0/8
${fwcmd} add 400 deny ip from 127.0.0.0/8 to any
 
${fwcmd} add 65000 pass all from any to any

firewall_enable="YES"
forewall_type="/etc/rc.firewall.open"
 
bruteblockd_enable="YES"
bruteblockd_table="1"
bruteblockd_flags="-s 5"

# шаблоны. при совпадении с которыми считается что пароль не правильный
regexp          = sshd.*Illegal user \S+ from (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
regexp1         = sshd.*Failed password for (?:illegal user )?\S+ from (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
regexp2         = sshd.*Failed keyboard-interactive\/pam for (?:invalid user )?\S+ from (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) Port \S+ ssh2
regexp3         = sshd.*authentication error for (?:illegal user )?\S+ from (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
regexp4         = sshd.*Invalid user \S+ from (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
 
# количество разрешенных попыток перед баном
max_count       = 4
 
# в течении какого времени эти попытки можно делать
within_time     = 60
 
# на какое время блочим
reset_ip       = 86400
 
# IPFW номер таблицы
ipfw2_table_no = 1

/usr/local/etc/rc.d/bruteblockd start
Starting bruteblockd.
radio# /usr/local/etc/rc.d/bruteblockd status
bruteblockd is running as pid 3752.

radio# ipfw table 1 list
195.46.x.x/32 1260946935