Hi Sylvain, Use PF rules to overload IPs that connect too often into a black hole. See pf.conf(5) man page, STATEFUL FILTERING topic, Stateful Tracking Options section, final example which uses overload.
block quick from <bad_hosts> pass in on $ext_if proto tcp to $webserver port www keep state (max-src-conn-rate 100/10, overload <bad_hosts> flush global) Same can be done for port ssh, except lower the rate to something that will catch the bad guys. Cheers, Brian > On Aug 26, 2026, at 3:25 PM, Sylvain Saboua <[email protected]> wrote: > > I remember when I first purchased my domain name and linked it > to my fixed IP address, without having even published it anywhere yet, > my /var/www/logs/access.log was full of attackers' weird requests. > > The same thing happens in /var/log/authlog even with a nonstandard > port for SSH forwarding. I suppose it would also be there in > /var/log/maillog would I have set an email server up, and in other > places. > > I know Peter Hansteen has worked on the latter case: > https://nxdomain.no/~peter/effective_spam_and_malware_countermeasures.html > But I am left bare facing the excessive malicious activity on my > httpd(8) and sshd(8) services. > > So here's my question : is there a preferred / good practice way on > OpenBSD to deflect attacker activity ? I'm not too worried about my > system being penetrated, although one is never too careful, but I am > regarding the workload this puts on my server and connexion. > > Cheers > -- > Sylvain Saboua > looking for a PDP-11 >
