On Saturday 25 June 2005 18:45, Ninneman, TJ wrote:
> I'm having some trouble on both my 5.3 and 5.4 FreeBSD servers running PF.
> My ruleset explicitly blocks outbound ssh from my servers to prevent
> attacks on other servers in the event that one of my servers is
> compromised.  The problem is that I have noticed (after a few days of the
> server being up) my daily run output showing both TCP and UDP packets being
> dropped outbound:
>
> block drop out quick on em0 proto tcp from any to any port = ssh [
> Evaluations: 437 Packets: 0 Bytes: 0 States: 0 ]
  ~~~~~~~~~~~               ^        ^
>
> block drop out quick on em0 proto udp from any to any port = ssh [
> Evaluations: 1505 Packets: 0 Bytes: 0 States: 0 ]
  ~~~~~~~~~~~                ^        ^
> My question is, are my servers compromised or am I misreading the run
> output?

You are misreading the output.  The "Evaluations" counter only shows that a 
packet was checked against the rule, unless Packets and Bytes are not 
increased, the packet didn't match.

You could check that yourself:  Just try to make a ssh connection from the 
server in question and see how the Packets/Bytes counter increase.

-- 
/"\  Best regards,                      | [EMAIL PROTECTED]
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | [EMAIL PROTECTED]
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News

Attachment: pgpdrAdhPPjEN.pgp
Description: PGP signature

Reply via email to