oss-sec mailing list archives
Re: speaking of DoS, openssh and dropbear (CVE-2006-1206)
From: The Fungi <fungi () yuggoth org>
Date: Thu, 5 Jan 2012 15:24:55 +0000
On 2012-01-05 22:22:21 +1100 (+1100), David Hicks wrote:
OpenBSD's pf also allows for connection rate limiting with the "max-src-conn-rate" restriction. I haven't investigated how this works in comparison to iptables/hashlimit or whether it can support grouping of addresses sharing a common mask.
As far as I know, it doesn't. I use it like this in front of my public shell servers: # stall brute force attacks... expects options like: # (max-src-conn 100, max-src-conn-rate 15/5, overload <brutes> flush global) # after a rule that can add brutes to the table of offenders # once an hour, a cron job removes all entries at least an hour old # (this can be adjusted near the end of /var/cron/tabs/root if necessary) # to see what's in the table: sudo pfctl -t brutes -T show # to manually remove entries: sudo pfctl -t brutes -T delete 1.2.3.4 5.6.7.8 table <brutes> persist block drop log quick from <brutes> [...] pass log quick proto tcp to $shell port ssh keep state ( max-src-conn 100, max-src-conn-rate 15/5, overload <brutes> flush global ) ...and then in /var/cron/tabs/root I have: 0 * * * * /sbin/pfctl -q -t brutes -T expire 3600 Works well enough for a single-address attacker or an attacker with a limited number of addresses available, but it's obviously not robust against an attacker who decides to source connections from their entire IPv6 /64. To date it's put a good dent in the brute-force account guessing noise in my logs, though I'm not sure how long that will last as more and more attackers start working around the increasing number of source tracking mechanisms throttling their efforts. -- { IRL(Jeremy_Stanley); WWW(http://fungi.yuggoth.org/); PGP(43495829); WHOIS(STANL3-ARIN); SMTP(fungi () yuggoth org); FINGER(fungi () yuggoth org); MUD(kinrui () katarsis mudpy org:6669); IRC(fungi () irc yuggoth org#ccl); }
Current thread:
- Re: speaking of DoS, openssh and dropbear (CVE-2006-1206), (continued)
- Re: speaking of DoS, openssh and dropbear (CVE-2006-1206) Kurt Seifried (Jan 01)
- Re: speaking of DoS, openssh and dropbear (CVE-2006-1206) Eitan Adler (Jan 01)
- Re: speaking of DoS, openssh and dropbear (CVE-2006-1206) Kurt Seifried (Jan 02)
- Re: speaking of DoS, openssh and dropbear (CVE-2006-1206) Nico Golde (Jan 02)
- Re: speaking of DoS, openssh and dropbear (CVE-2006-1206) Solar Designer (Jan 02)
- Re: speaking of DoS, openssh and dropbear (CVE-2006-1206) Nico Golde (Jan 03)
- Re: speaking of DoS, openssh and dropbear (CVE-2006-1206) Solar Designer (Jan 03)
- Re: speaking of DoS, openssh and dropbear (CVE-2006-1206) Kurt Seifried (Jan 03)
- Re: speaking of DoS, openssh and dropbear (CVE-2006-1206) Solar Designer (Jan 11)
- Re: speaking of DoS, openssh and dropbear (CVE-2006-1206) David Hicks (Jan 05)
- Re: speaking of DoS, openssh and dropbear (CVE-2006-1206) The Fungi (Jan 05)
- Re: speaking of DoS, openssh and dropbear (CVE-2006-1206) Kurt Seifried (Jan 05)