Re: Cleanup portsentry's iptables rules

Henrique de Moraes Holschuh writes: > I really wish IPSET was merged upstream, but it must be lacking something > fundamental to earn that right (IPv6 support, perhaps?), since it has been > around for a long time now, and it is fully maintained. I believe the upstream plan is to make nftables a

Re: Cleanup portsentry's iptables rules (WAS: HEAD's UP: possible 0day SSH exploit in the wild)

On Mon, 13 Jul 2009, Maik Holtkamp wrote: > I decided to follow this and on the weekend iptables blocked about 70 > IPs. I am afraid that after some time the box will be DOSed by the > crowded INPUT chain. The only _real_ fix for that is to use IPSET (patch for netfilter) to deal with IPv4, and co

Re: Cleanup portsentry's iptables rules (WAS: HEAD's UP: possible 0day SSH exploit in the wild)

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, Maik Holtkamp wrote/schrieb @ 13.07.2009 11:12: > tail -n -20 | sed "s/^-A/-D/" | \ s/tail/head/ Sorry. - -- - - bye maik -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.9 (MingW32) Comment: Signature of Maik Holtkamp iEYEARECAAYFAkpbA

Cleanup portsentry's iptables rules (WAS: HEAD's UP: possible 0day SSH exploit in the wild)

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, Clemens Pfaffinger wrote/schrieb @ 07.07.2009 23:23: > this is standard for me. I always change the port of the openSSH-server. > > My (current) solution is: > Portsentry listens on port 22, while openSSH-server has another port. > Every port sc