3 deleted 28 characters in body; deleted 86 characters in body
source | link

I am setting up an SFTP server for me and my friends and I am trying to stop brute force attempts. I am new to Unix and Linux.

I have read many articles on how to get pf to stop brute force attacks and am not having any luck. I may be missing something in the setup that I am not aware of or doing it all wrong.

I am running OpenBSD 6.4 Here is my current /etc/pf.conf

#       $OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 s then Exp $
#
# See pf.conf(5) and /etc/examples/pf.conf
set skip on lo
block return    # block stateless traffic
pass            # establish keep-state
# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010
# Port build user does not need network
block return out log proto {tcp udp} user _pbuild
ext_if="em0"
antispoof quick for ($ext_if) #No IP or GPS SPOOFING allowed here :)
table <bruteforce> persist
block quick from <bruteforce>
pass inet proto tcp to any:network port 22 \
        keep state (max-src-conn 10, max-src-conn-rate 5/5, \
         overload <bruteforce> flush global)
table <ssh_block> persist
block quick from <ssh_block> to any

When I checked the tables brute-force and ssh_block they didn't exist. So on ssh_block I ran the command

pfctl -t ssh_block -T add 218.92.1.138
1 table created.
1/1 addresses added.
pfctl -t ssh_block -T show
218.92.1.138

However my /var/log/authlog is still filling up with attempts from that ip address.

What am I missing?

I am setting up an SFTP server for me and my friends and I am trying to stop brute force attempts. I am new to Unix and Linux.

I have read many articles on how to get pf to stop brute force attacks and am not having any luck. I may be missing something in the setup that I am not aware of or doing it all wrong.

I am running OpenBSD 6.4 Here is my current /etc/pf.conf

#       $OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 s then Exp $
#
# See pf.conf(5) and /etc/examples/pf.conf
set skip on lo
block return    # block stateless traffic
pass            # establish keep-state
# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010
# Port build user does not need network
block return out log proto {tcp udp} user _pbuild
ext_if="em0"
antispoof quick for ($ext_if) #No IP or GPS SPOOFING allowed here :)
table <bruteforce> persist
block quick from <bruteforce>
pass inet proto tcp to any:network port 22 \
        keep state (max-src-conn 10, max-src-conn-rate 5/5, \
         overload <bruteforce> flush global)
table <ssh_block> persist
block quick from <ssh_block> to any

When I checked the tables brute-force and ssh_block they didn't exist. So on ssh_block I ran the command

pfctl -t ssh_block -T add 218.92.1.138
1 table created.
1/1 addresses added.
pfctl -t ssh_block -T show
218.92.1.138

However my /var/log/authlog is still filling up with attempts from that ip address.

What am I missing?

I am setting up an SFTP server for me and my friends and I am trying to stop brute force attempts.

I have read many articles on how to get pf to stop brute force attacks and am not having any luck.

I am running OpenBSD 6.4 Here is my current /etc/pf.conf

#       $OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 s then Exp $
#
# See pf.conf(5) and /etc/examples/pf.conf
set skip on lo
block return    # block stateless traffic
pass            # establish keep-state
# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010
# Port build user does not need network
block return out log proto {tcp udp} user _pbuild
ext_if="em0"
antispoof quick for ($ext_if) #No IP or GPS SPOOFING allowed here :)
table <bruteforce> persist
block quick from <bruteforce>
pass inet proto tcp to any:network port 22 \
        keep state (max-src-conn 10, max-src-conn-rate 5/5, \
         overload <bruteforce> flush global)
table <ssh_block> persist
block quick from <ssh_block> to any

When I checked the tables brute-force and ssh_block they didn't exist. So on ssh_block I ran the command

pfctl -t ssh_block -T add 218.92.1.138
1 table created.
1/1 addresses added.
pfctl -t ssh_block -T show
218.92.1.138

However my /var/log/authlog is still filling up with attempts from that ip address.

What am I missing?

2 Format content
source | link

pf not stopping bruteforce attempts.

Hello all iI am setting up an sftpSFTP server for me and my friends and iI am trying to stop brute force attempts. I am new to Unix and Linux.

I have read many articles on how to get pf to stop brute force attacks and am not having any luck. I may be missing something in the setup that iI am not aware of or doing it all wrong.

I am running OpenBSD 6.4 Here is my current /etc/pf.conf

#       $OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthens then Exp $
#
# See pf.conf(5) and /etc/examples/pf.conf
set skip on lo
block return    # block stateless traffic
pass            # establish keep-state
# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010
# Port build user does not need network
block return out log proto {tcp udp} user _pbuild
ext_if="em0"
antispoof quick for ($ext_if) #No IP or GPS SPOOFING allowed here :)
table <bruteforce> persist
block quick from <bruteforce>
pass inet proto tcp to any:network port 22 \
        keep state (max-src-conn 10, max-src-conn-rate 5/5, \
         overload <bruteforce> flush global)
table <ssh_block> persist
block quick from <ssh_block> to any

When I checked the tables bruteforcebrute-force and ssh_block they didn't exist. So on ssh_block I ran the command

pfctl -t ssh_block -T add 218.92.1.138
1 table created.
1/1 addresses added.
pfctl -t ssh_block -T show
218.92.1.138

However my /var/log/authlog is still filling up with attempts from that ip address.

What am iI missing?

pf not stopping bruteforce attempts.

Hello all i am setting up an sftp server for me and my friends and i am trying to stop brute force attempts. I am new to Unix and Linux.

I have read many articles on how to get pf to stop brute force attacks and am not having any luck. I may be missing something in the setup that i am not aware of or doing it all wrong.

I am running OpenBSD 6.4 Here is my current /etc/pf.conf

#       $OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $
#
# See pf.conf(5) and /etc/examples/pf.conf
set skip on lo
block return    # block stateless traffic
pass            # establish keep-state
# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010
# Port build user does not need network
block return out log proto {tcp udp} user _pbuild
ext_if="em0"
antispoof quick for ($ext_if) #No IP or GPS SPOOFING allowed here :)
table <bruteforce> persist
block quick from <bruteforce>
pass inet proto tcp to any:network port 22 \
        keep state (max-src-conn 10, max-src-conn-rate 5/5, \
         overload <bruteforce> flush global)
table <ssh_block> persist
block quick from <ssh_block> to any

When I checked the tables bruteforce and ssh_block they didn't exist. So on ssh_block I ran the command

pfctl -t ssh_block -T add 218.92.1.138
1 table created.
1/1 addresses added.
pfctl -t ssh_block -T show
218.92.1.138

However my /var/log/authlog is still filling up with attempts from that ip address.

What am i missing?

pf not stopping bruteforce attempts

I am setting up an SFTP server for me and my friends and I am trying to stop brute force attempts. I am new to Unix and Linux.

I have read many articles on how to get pf to stop brute force attacks and am not having any luck. I may be missing something in the setup that I am not aware of or doing it all wrong.

I am running OpenBSD 6.4 Here is my current /etc/pf.conf

#       $OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 s then Exp $
#
# See pf.conf(5) and /etc/examples/pf.conf
set skip on lo
block return    # block stateless traffic
pass            # establish keep-state
# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010
# Port build user does not need network
block return out log proto {tcp udp} user _pbuild
ext_if="em0"
antispoof quick for ($ext_if) #No IP or GPS SPOOFING allowed here :)
table <bruteforce> persist
block quick from <bruteforce>
pass inet proto tcp to any:network port 22 \
        keep state (max-src-conn 10, max-src-conn-rate 5/5, \
         overload <bruteforce> flush global)
table <ssh_block> persist
block quick from <ssh_block> to any

When I checked the tables brute-force and ssh_block they didn't exist. So on ssh_block I ran the command

pfctl -t ssh_block -T add 218.92.1.138
1 table created.
1/1 addresses added.
pfctl -t ssh_block -T show
218.92.1.138

However my /var/log/authlog is still filling up with attempts from that ip address.

What am I missing?

1
source | link

pf not stopping bruteforce attempts.

Hello all i am setting up an sftp server for me and my friends and i am trying to stop brute force attempts. I am new to Unix and Linux.

I have read many articles on how to get pf to stop brute force attacks and am not having any luck. I may be missing something in the setup that i am not aware of or doing it all wrong.

I am running OpenBSD 6.4 Here is my current /etc/pf.conf

#       $OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $
#
# See pf.conf(5) and /etc/examples/pf.conf
set skip on lo
block return    # block stateless traffic
pass            # establish keep-state
# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010
# Port build user does not need network
block return out log proto {tcp udp} user _pbuild
ext_if="em0"
antispoof quick for ($ext_if) #No IP or GPS SPOOFING allowed here :)
table <bruteforce> persist
block quick from <bruteforce>
pass inet proto tcp to any:network port 22 \
        keep state (max-src-conn 10, max-src-conn-rate 5/5, \
         overload <bruteforce> flush global)
table <ssh_block> persist
block quick from <ssh_block> to any

When I checked the tables bruteforce and ssh_block they didn't exist. So on ssh_block I ran the command

pfctl -t ssh_block -T add 218.92.1.138
1 table created.
1/1 addresses added.
pfctl -t ssh_block -T show
218.92.1.138

However my /var/log/authlog is still filling up with attempts from that ip address.

What am i missing?