Re: SSH Brute Force attempts

2008-09-30 Thread Bob Bishop
Hi, On 30 Sep 2008, at 01:10, Rich Healey wrote: Recently I'm getting a lot of brute force attempts on my server, in the past I've used various tips and tricks with linux boxes but many of them were fairly linux specific. What do you BSD guys use for this purpose? [various solutions prop

Re: SSH Brute Force attempts

2008-09-30 Thread Jeroen Ruigrok van der Werven
-On [20080930 05:14], Rich Healey ([EMAIL PROTECTED]) wrote: >What do you BSD guys use for this purpose? I actually use blockhosts, which is a Python solution you tie into hosts.allow. http://www.aczoom.com/cms/blockhosts -- Jeroen Ruigrok van der Werven / asmodai イェルーン ラウフロック ヴァン デル ウェル

Re: SSH Brute Force attempts

2008-09-30 Thread Ollivier Robert
According to Henrik Hudson: > Yeap, -security > > However, also try this in pf.conf (specific rules related to this; you'll > need > more for a real pf.conf): > > table { } persist > block in quick from > pass in on $ext_if proto tcp from any to ($ext_if) port ssh keep state > (max-src-conn

Re: SSH Brute Force attempts

2008-09-30 Thread Oliver Fromme
Rich Healey wrote: > Recently I'm getting a lot of brute force attempts on my server, in the > past I've used various tips and tricks with linux boxes but many of them > were fairly linux specific. > > What do you BSD guys use for this purpose? There's nothing that replaces using either *goo

How do I unchown a directory after I: chown -R /etc ???

2008-09-30 Thread Mike Price
How do I unchown a directory after I: chown -R /etc ___ freebsd-hackers@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-hackers To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Re: How do I unchown a directory after I: chown -R /etc ???

2008-09-30 Thread Jeroen Ruigrok van der Werven
-On [20080930 11:26], Mike Price ([EMAIL PROTECTED]) wrote: >How do I unchown a directory after I: chown -R /etc There is no unchown. You either rechown with the correct users or you use mtree with one of the dist files in /etc/mtree to recreate the directory structure with the correct rig

Re: ATA Security patch to atacontrol

2008-09-30 Thread Daniel Roethlisberger
Andrey V. Elsukov <[EMAIL PROTECTED]> 2008-09-30: > Jeremy Chadwick wrote: > >Can you provide me datasheet and technical reference material to what > >"ATA Security" is? Which ATA specification is this documented in? I'd > >like to read it. > > I think you can found it in ATA-ATAPI-7 vol.1: "4.7

Re: SSH Brute Force attempts

2008-09-30 Thread Jeremy Chadwick
On Tue, Sep 30, 2008 at 09:56:32AM +0200, Jeroen Ruigrok van der Werven wrote: > -On [20080930 05:14], Rich Healey ([EMAIL PROTECTED]) wrote: > >What do you BSD guys use for this purpose? > > I actually use blockhosts, which is a Python solution you tie into > host

Re: How do I unchown a directory after I: chown -R /etc ???

2008-09-30 Thread Jeremy Chadwick
On Tue, Sep 30, 2008 at 02:25:54AM -0700, Mike Price wrote: > How do I unchown a directory after I: chown -R /etc You can't. Restore /etc from backups. And ***please*** stop posting this stuff to -hackers. It is not the appropriate list for it. Start using -questions. -- | Jeremy Chadwick

Re: SSH Brute Force attempts

2008-09-30 Thread Dag-Erling Smørgrav
Oliver Fromme <[EMAIL PROTECTED]> writes: > If you're merely annoyed about the large amount of logging entries > caused by the break-in attempts, a good solution is to move the sshd > service from the standard port 22 to a different, non-standard port The best choice is 443, as many corporate fire

Re: How do I unchown a directory after I: chown -R /etc ???

2008-09-30 Thread Dag-Erling Smørgrav
Jeremy Chadwick <[EMAIL PROTECTED]> writes: > Mike Price <[EMAIL PROTECTED]> writes: > > How do I unchown a directory after I: chown -R /etc > You can't. Restore /etc from backups. Better solution: use mtree to generate a spec file from a clean tree and apply it. You can get a clean copy of etc

Re: SSH Brute Force attempts

2008-09-30 Thread Lars Engels
Quoting Rich Healey <[EMAIL PROTECTED]>: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Recently I'm getting a lot of brute force attempts on my server, in the past I've used various tips and tricks with linux boxes but many of them were fairly linux specific. What do you BSD guys use for this

Re: ATA Security patch to atacontrol

2008-09-30 Thread Bruce Cran
Daniel Roethlisberger wrote: Andrey V. Elsukov <[EMAIL PROTECTED]> 2008-09-30: Jeremy Chadwick wrote: Can you provide me datasheet and technical reference material to what "ATA Security" is? Which ATA specification is this documented in? I'd like to read it. I think you can fou

Re: SSH Brute Force attempts

2008-09-30 Thread Oliver Fromme
Ollivier Robert <> wrote: > According to Henrik Hudson: > > Yeap, -security > > > > However, also try this in pf.conf (specific rules related to this; you'll > > need > > more for a real pf.conf): > > > > table { } persist > > block in quick from > > pass in on $ext_if proto tcp fro

Re: SSH Brute Force attempts

2008-09-30 Thread Matthew Seaman
-BEGIN PGP SIGNED MESSAGE- Hash: RIPEMD160 Oliver Fromme wrote: | Ollivier Robert <> wrote: | > According to Henrik Hudson: | > > Yeap, -security | > > | > > However, also try this in pf.conf (specific rules related to this; you'll need | > > more for a real pf.conf): | > > | >

Re: SSH Brute Force attempts

2008-09-30 Thread Daniel Gerzo
Hello guys, On Mon, 29 Sep 2008 20:30:33 -0700, Jeremy Chadwick <[EMAIL PROTECTED]> wrote: > On Tue, Sep 30, 2008 at 10:10:59AM +1000, Rich Healey wrote: >> Recently I'm getting a lot of brute force attempts on my server, in the >> past I've used various tips and tricks with linux boxes but many

Re: SSH Brute Force attempts

2008-09-30 Thread Pierre Riteau
On Tue, Sep 30, 2008 at 04:01:26PM +0200, Oliver Fromme wrote: > Ollivier Robert <> wrote: > > According to Henrik Hudson: > > > Yeap, -security > > > > > > However, also try this in pf.conf (specific rules related to this; > you'll need > > > more for a real pf.conf): > > > > > > table

Re: SSH Brute Force attempts

2008-09-30 Thread Oliver Fromme
Pierre Riteau wrote: > Oliver Fromme wrote: > > Ollivier Robert wrote: > > > According to Henrik Hudson: > > > > Yeap, -security > > > > > > > > However, also try this in pf.conf (specific rules related to this; > > > > you'll need > > > > more for a real pf.conf): > > > > > > > > tab

Re: SSH Brute Force attempts

2008-09-30 Thread Bill Moran
In response to Oliver Fromme <[EMAIL PROTECTED]>: > Pierre Riteau wrote: > > > Because the 3-way handshake ensures that the source address is not > being > > spoofed, more aggressive action can be taken based on these limits. > > s/not being spoofed/more difficult to spoofe/ ;-) O

Re: SSH Brute Force attempts

2008-09-30 Thread Oliver Fromme
Bill Moran wrote: > In response to Oliver Fromme <[EMAIL PROTECTED]>: > > Pierre Riteau wrote: > > > > > Because the 3-way handshake ensures that the source address is not > > > being > > > spoofed, more aggressive action can be taken based on these limits. > > > > s/not being

Re: SSH Brute Force attempts

2008-09-30 Thread Igor Mozolevsky
2008/9/30 Oliver Fromme <[EMAIL PROTECTED]>: > > Bill Moran wrote: > > In response to Oliver Fromme <[EMAIL PROTECTED]>: > > > Pierre Riteau wrote: > > > > > > > Because the 3-way handshake ensures that the source address is > not being > > > > spoofed, more aggressive action can be

[powerd] Adding different adaptive-mode settings for each power source

2008-09-30 Thread gelraen
Hi, I've needed to set different idle levels for adaptive mode while on battery or on AC power. Cause powerd can only set mode (min, max, adp) for each power source, I've added this ability and it seems to be a good idea to share this improvement with others. Best regards, gelraen. P.S.: Sorry f

Re: ATA Security patch to atacontrol

2008-09-30 Thread Daniel Roethlisberger
Daniel Roethlisberger <[EMAIL PROTECTED]> 2008-09-30: > I've added experimental support for the ATA Security command set to > atacontrol. Please test and review. If you have some spare disk(s) > with ATA Security support and a BIOS which does not freeze the security > configuration, I'd like to h