差異處

這裏顯示兩個版本的差異處。

--- freebsd:pf [2007/08/07 22:12] – wenpei
+++ freebsd:pf [2010/04/06 12:14] (目前版本) – wenpei
@@ 行 34: / 行 34: @@
   # /etc/rc.d/pf start
+====== SSH Brute Force Blocker with PF on FreeBSD ======
+http://home.earthlink.net/~valiantsoul/pf.html
+/etc/pf.conf 中增加
+  table <bruteforce> persist file "/var/db/blacklist"
+  block quick from <bruteforce>
+程式碼
+<code>
+#!/usr/bin/perl
+use strict;
+my @assholes = ();
+open (IN, "/var/log/auth.log");
+while (<IN>) {
+        if ($_ =~ /Invalid user.*from ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)/) {
+                push(@assholes, $1);
+        }
+        if ($_ =~ /Did not receive identification string from ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)/) {
+                push(@assholes, $1);
+        }
+}
+close (IN);
+@assholes = sort {lc($a) cmp lc($b)} @assholes;
+my @allowedIPs = ();
+open (IN, "/var/db/allowed-ips");
+while (<IN>) {
+        if ($_ =~ /[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/) {
+                push(@allowedIPs, $_);
+        }
+}
+close (IN);
+chop(@allowedIPs);
+my $tmp = "";
+foreach my $asshole (@assholes) {
+        if ($asshole eq $tmp) {
+                $asshole = "";
+        } else {
+                if ($asshole =~ /127\.0\.0\.1/) {
+                        $asshole = "";
+                }
+                if ($asshole =~ /192\.168\.[0-9]+\.[0-9]+/) {
+                        $asshole = "";
+                }
+                foreach my $allowedIP (@allowedIPs) {
+                        if ($asshole =~ /$allowedIP/) {
+                                $asshole = "";
+                        }
+                }
+                $tmp = $asshole;
+        }
+}
+@assholes = sort {lc($b) cmp lc($a)} @assholes;
+my $popCount = 0;
+foreach my $asshole (reverse @assholes) {
+        if ($asshole eq "") {
+                $popCount++;
+        }
+}
+for (my $i = 0; $i < $popCount; $i++) {
+        pop (@assholes);
+}
+my $list = "";
+foreach my $asshole (@assholes) {
+        $list = $list . $asshole . " ";
+}
+exec "/sbin/pfctl -t bruteforce -T add $list";
+</code>
+加入 Syslog 中
+/etc/syslog.conf
+  auth.info;authpriv.info          | exec /usr/bin/perl /sbin/bruteforcer.pl
+例外之黑/白名單列表
+<code>
+touch /var/db/blacklist
+chmod 644 /var/db/blacklist
+touch /var/db/allowed-ips
+chmod 644 /var/db/allowed-ips
+</code>
+觀看已經紀錄的列表
+  pfctl -t bruteforce -T show
+====== Denyhosts ======
+Reference: http://blog.wu-boy.com/2008/12/26/663/