MESSAGE
| DATE | 2005-06-08 |
| FROM | Billy
|
| SUBJECT | Re: [NYLXS - HANGOUT] ssh help
|
From owner-hangout-at-mrbrklyn.com Wed Jun 8 14:33:16 2005
Received: from www2.mrbrklyn.com (localhost [127.0.0.1])
by www2.mrbrklyn.com (8.13.1/8.13.1/SuSE Linux 0.7) with ESMTP id j58IXE9n016150
for ; Wed, 8 Jun 2005 14:33:16 -0400
Received: (from majordomo-at-localhost)
by www2.mrbrklyn.com (8.13.1/8.13.1/Submit) id j58IXEvm016149
for hangout-outgoings; Wed, 8 Jun 2005 14:33:14 -0400
X-Authentication-Warning: www2.mrbrklyn.com: majordomo set sender to owner-hangout-at-nylxs.com using -f
Received: from mail.dadadada.net (MAIL.DADADADA.NET [209.48.2.106])
by www2.mrbrklyn.com (8.13.1/8.13.1/SuSE Linux 0.7) with ESMTP id j58IXClN016146
for ; Wed, 8 Jun 2005 14:33:14 -0400
Received: from sugar ([127.0.0.1])
by mail.dadadada.net with esmtp (Exim 3.35 #1 (Debian))
id 1Dg5Lj-0004Hp-00
for ; Wed, 08 Jun 2005 14:32:23 -0400
Message-ID: <42A739B5.1020109-at-dadadada.net>
Date: Wed, 08 Jun 2005 14:32:21 -0400
From: Billy
User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206)
X-Accept-Language: en-us, en
MIME-Version: 1.0
CC: hangout-at-mrbrklyn.com
Subject: Re: [NYLXS - HANGOUT] ssh help
References: <1118236919.4381.6.camel-at-stat29.mrbrklyn.com>
In-Reply-To: <1118236919.4381.6.camel-at-stat29.mrbrklyn.com>
X-Enigmail-Version: 0.89.5.0
X-Enigmail-Supports: pgp-inline, pgp-mime
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Sender: owner-hangout-at-mrbrklyn.com
Precedence: bulk
X-Keywords:
X-UID: 78
Status: RO
Content-Length: 935
Lines: 28
Ruben Safir wrote:
> /*
> * SSHLOCKOUT_PF.C
> *
> * Written by Matthew Dillon
> * Modified to use PF tables by Scott Ullrich
> *
> * Use: pipe syslog auth output to this program. e.g. in /etc/syslog.conf:
> *
> * auth.info;authpriv.info /var/log/auth.log
> * auth.info;authpriv.info |exec /root/adm/sshlockout
> *
> * Detects failed ssh login and attempts to map out the originating IP
> * using PF's tables.
> *
> * setup a rule in your pf ruleset (near the top) similar to:
> * block in log quick from to any label "sshlockout"
> *
> * *VERY* simplistic. ipfw entries do not timeout, duplicate entries may
> * occur (though normally not since ssh won't see new connections from
> * the IP otherwise), there are no checks made for local IPs or nets,
> * or for prior successful logins, etc.
> */
Is there a question or statement in here somewhere? Some context?
|
|
