Re: speaking of DoS, openssh and dropbear (CVE-2006-1206)

[The Fungi <fungi () yuggoth org>]

On 2012-01-05 22:22:21 +1100 (+1100), David Hicks wrote:
> OpenBSD's pf also allows for connection rate limiting with the
> "max-src-conn-rate" restriction. I haven't investigated how this works
> in comparison to iptables/hashlimit or whether it can support grouping
> of addresses sharing a common mask.

As far as I know, it doesn't. I use it like this in front of my
public shell servers:

   # stall brute force attacks... expects options like:
   # (max-src-conn 100, max-src-conn-rate 15/5, overload <brutes> flush global)
   # after a rule that can add brutes to the table of offenders
   # once an hour, a cron job removes all entries at least an hour old
   # (this can be adjusted near the end of /var/cron/tabs/root if necessary)
   # to see what's in the table: sudo pfctl -t brutes -T show
   # to manually remove entries: sudo pfctl -t brutes -T delete
   1.2.3.4 5.6.7.8
   table <brutes> persist
   block drop log quick from <brutes>
[...]
   pass log quick proto tcp to $shell port ssh keep state ( max-src-conn 100, max-src-conn-rate 15/5, overload <brutes> 
flush global )

...and then in /var/cron/tabs/root I have:

   0 * * * * /sbin/pfctl -q -t brutes -T expire 3600

Works well enough for a single-address attacker or an attacker with
a limited number of addresses available, but it's obviously not
robust against an attacker who decides to source connections from
their entire IPv6 /64. To date it's put a good dent in the
brute-force account guessing noise in my logs, though I'm not sure
how long that will last as more and more attackers start working
around the increasing number of source tracking mechanisms
throttling their efforts.
-- 
{ IRL(Jeremy_Stanley); WWW(http://fungi.yuggoth.org/); PGP(43495829);
WHOIS(STANL3-ARIN); SMTP(fungi () yuggoth org); FINGER(fungi () yuggoth org);
MUD(kinrui () katarsis mudpy org:6669); IRC(fungi () irc yuggoth org#ccl); }