Aus immerda
Zur Navigation springen Zur Suche springen



Transparente Firewall

Stop SSH Brute-Force

Rules for your pf:

table <bruteforce> persist
block quick from <bruteforce>
pass quick proto { tcp, udp } from any to any port ssh \
       flags S/SA keep state \
       (max-src-conn 15, max-src-conn-rate 5/3, \
       overload <bruteforce> flush global)

> OpenBSD 4.1 you can cron the following command to delete old entries in the table:

pfctl -t bruteforce -T expire 86400

where 86400 specifies 24*60*60 seconds = 1 day, which means that all entries older than one day will be deleted.