[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120105152454.GT723@yuggoth.org>
Date: Thu, 5 Jan 2012 15:24:55 +0000
From: The Fungi <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: Re: speaking of DoS, openssh and dropbear
(CVE-2006-1206)
On 2012-01-05 22:22:21 +1100 (+1100), David Hicks wrote:
> OpenBSD's pf also allows for connection rate limiting with the
> "max-src-conn-rate" restriction. I haven't investigated how this works
> in comparison to iptables/hashlimit or whether it can support grouping
> of addresses sharing a common mask.
As far as I know, it doesn't. I use it like this in front of my
public shell servers:
# stall brute force attacks... expects options like:
# (max-src-conn 100, max-src-conn-rate 15/5, overload <brutes> flush global)
# after a rule that can add brutes to the table of offenders
# once an hour, a cron job removes all entries at least an hour old
# (this can be adjusted near the end of /var/cron/tabs/root if necessary)
# to see what's in the table: sudo pfctl -t brutes -T show
# to manually remove entries: sudo pfctl -t brutes -T delete
1.2.3.4 5.6.7.8
table <brutes> persist
block drop log quick from <brutes>
[...]
pass log quick proto tcp to $shell port ssh keep state ( max-src-conn 100, max-src-conn-rate 15/5, overload <brutes> flush global )
...and then in /var/cron/tabs/root I have:
0 * * * * /sbin/pfctl -q -t brutes -T expire 3600
Works well enough for a single-address attacker or an attacker with
a limited number of addresses available, but it's obviously not
robust against an attacker who decides to source connections from
their entire IPv6 /64. To date it's put a good dent in the
brute-force account guessing noise in my logs, though I'm not sure
how long that will last as more and more attackers start working
around the increasing number of source tracking mechanisms
throttling their efforts.
--
{ IRL(Jeremy_Stanley); WWW(http://fungi.yuggoth.org/); PGP(43495829);
WHOIS(STANL3-ARIN); SMTP(fungi@...goth.org); FINGER(fungi@...goth.org);
MUD(kinrui@...arsis.mudpy.org:6669); IRC(fungi@....yuggoth.org#ccl); }
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
