Primul pas ca sa evitam aceasta situatie este sa activam firewalul din freebsd pentru asta trebuie sa intrati in /etc/rc.conf
si sa adaugati urmatoarele linii
Cod: Selectaţi tot
pf_enable="YES"
pf_rules="/etc/pf.conf"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pflog_flags=""
Pasul urmator este sa intram in /etc/pf.conf si sa adaugam urmatoarea linie
Cod: Selectaţi tot
block in all
pass in quick on lo0
pass out quick on lo0
table <block> persist file "/var/db/[i]security[/i]"
block quick from <bloqueo>
pass in quick on sis0 proto tcp from any to any port 22 keep state
pass in quick on sis0 proto tcp from any to any port 80 keep state
pass in quick on sis0 proto tcp from any to any port 3690 keep state
pass out all keep state
Acum trebuie sa creem fisierul "security" si sa setam permisiunile 644, asa ca ne ajutam de urmatoarele comenzi.
Cod: Selectaţi tot
touch /var/db/security
chmod 644 /var/db/security
Cod: Selectaţi tot
#!/usr/bin/perl
use strict;
my @assholes = ();
open (IN, "/var/log/auth.log");
while (<IN>) {
if ($_ =~ /Invalid user.*from ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)/) {
push(@assholes, $1);
}
if ($_ =~ /Did not receive identification string from ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)/) {
push(@assholes, $1);
}
}
close (IN);
@assholes = sort {lc($a) cmp lc($b)} @assholes;
my @allowedIPs = ();
open (IN, "/var/db/allowed-ips");
while (<IN>) {
if ($_ =~ /[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/) {
push(@allowedIPs, $_);
}
}
close (IN);
chop(@allowedIPs);
my $tmp = "";
foreach my $asshole (@assholes) {
if ($asshole eq $tmp) {
$asshole = "";
} else {
if ($asshole =~ /127\.0\.0\.1/) {
$asshole = "";
}
if ($asshole =~ /192\.168\.[0-9]+\.[0-9]+/) {
$asshole = "";
}
foreach my $allowedIP (@allowedIPs) {
if ($asshole =~ /$allowedIP/) {
$asshole = "";
}
}
$tmp = $asshole;
}
}
@assholes = sort {lc($b) cmp lc($a)} @assholes;
my $popCount = 0;
foreach my $asshole (reverse @assholes) {
if ($asshole eq "") {
$popCount++;
}
}
for (my $i = 0; $i < $popCount; $i++) {
pop (@assholes);
}
my $list = "";
foreach my $asshole (@assholes) {
$list = $list . $asshole . " ";
}
exec "/sbin/pfctl -t bloqueo -T add $list";
Cod: Selectaţi tot
chmod 751 security.plCod: Selectaţi tot
auth.info;authpriv.info 
.
de 
de