> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Mike Hauber > Sent: Wednesday, September 08, 2004 9:35 AM > To: [EMAIL PROTECTED] > Subject: Re: Tar pitting automated attacks > > > I realize this is probably a dumb question (I quietly drop > everything incoming unless it's keep-state, and I only > allow ssh internally)... > > If you're needing to ssh to your machine from a limited > range of IPs, then why not tell your PF to drop incoming > unless it's within that range?
Yes, that is how it is usually done. But the OP's goal was to tie up the attacker's resources so the attacker cannot go and bang on other people. Blocking access to the ssh port to most of the Internet actually helps the attacker, because the attacker will attempt to open a connection, and 5 minutes later when the connection open has still not completed, the attacker will mark off that IP and continue onto attacking the next person. So it comes down to what do you want - if you want to clean your logs and not be attacked, then use port filtering, otherwise if you want to waste attackers resources, make sure your ssh port is available, and use good passwords so an attack won't succeed. tarpitting is equivalent to port filtering from the attackers point of view - they know how to detect a tar pit and will move on and not get stuck in it. Ted _______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
