Listar command results: -- Binary/unsupported file stripped by Listar --

2011-02-10 Thread Listar
Request received for list 'wave.splitter' via request address. >> This message was not delivered due to the following reason(s): Unknown command. >> Your message could not be delivered because the destination server >> was Unknown command. >> not reachable within the allowed queue period. The am

pf user tags: maximum lifespan / accessibility

2011-02-10 Thread adrian ilarion ciobanu
Hello, My problem: I need to tag packets from both IPFW and PF for later processing by another PFIL filter (let's call it FILTY). I need this because IPFW and PF can be successfully used to some extent to take care of a big part of my packet matching rules and it would be stupid to implement aga

RE: brutal SSH attacks

2011-02-10 Thread Daniel.Hartmeier
Ah, so I guess this does deserve some further debugging :) First, make sure those connections are matching the expected rule: Watch an ongoing scan, note the scanner's IP. Run # pfctl -vvss | grep -A 2 Note the rule number printed right-most in every third line, and compare them to the outp

Re: brutal SSH attacks

2011-02-10 Thread Damien Fleuriot
On 2/8/11 11:06 PM, Vadym Chepkov wrote: > > On Feb 8, 2011, at 2:58 PM, Mike Tancsa wrote: > >> On 2/8/2011 1:11 PM, Vadym Chepkov wrote: >>> Hi, >>> >>> Could somebody help in figuring out why PF configuration meant to prevent >>> brutal SSH attacks doesn't work. >>> >>> Here are the relevan

Re: brutal SSH attacks

2011-02-10 Thread Damien Fleuriot
On 2/9/11 10:00 PM, Vadym Chepkov wrote: > > > On Feb 9, 2011, at 5:00 AM, Damien Fleuriot wrote: > >> Looks like my previous message didn't make it to the list. >> >> >> @OP: nothing indicates that your table is getting populated correctly. >> >> While this doesn't address your main issue, yo

Re: brutal SSH attacks

2011-02-10 Thread Vadym Chepkov
On Feb 10, 2011, at 2:52 AM, Daniel Hartmeier wrote: > >> Feb 8 11:27:57 castor sshd[57332]: Invalid user ashley from 113.185.0.16 > > diff = 3, count -= 8770 * 3 / 60, += 1000, count = 9332, last = 57 > > Now count is larger than your limit 9000, and the threshold is > triggered, after 15 con