Re: Blocking SSH Brute-Force Attacks: What Am I Doing Wrong? (Solved!)

2006-11-15 Thread Leo L. Schwab
After instrumenting 'bruteblock' (and accidentally causing auth.log to explode), I discovered that the ssh.conf file that ships with it won't work on FreeBSD 6.1 (or at least my copy of it). The shipped regexp looks for illegal users. But 'sshd' on FreeBSD 6.1 records login

Re: Blocking SSH Brute-Force Attacks: What Am I Doing Wrong?

2006-11-14 Thread Leo L. Schwab
On Mon, Nov 13, 2006 at 09:16:35PM +0100, Erik Norgaard wrote: Honestly, I wouldn't worry about it: review your config and make some simple choices to reduce the noise, see this article: http://www.securityfocus.com/infocus/1876 But I rather thought that was the point of

Re: Blocking SSH Brute-Force Attacks: What Am I Doing Wrong?

2006-11-14 Thread Leo L. Schwab
On Mon, Nov 13, 2006 at 10:10:58AM +0100, Frank Staals wrote: I had the same 'problem'. As said it's not realy a problem since FreeBSD will hold just fine if you don't have any rather stupid user + pass combinations. While FreeBSD and OpenSSH are very good, I'm not prepared to rely

Blocking SSH Brute-Force Attacks: What Am I Doing Wrong?

2006-11-12 Thread Leo L. Schwab
I recently installed FreeBSD 6.1 on my gateway. It replaced an installation of FreeBSD 4.6.8 (fresh install, not an upgrade) on which I had disabled the SSH server. Since all the bugs in SSH are fixed now ( :-) ), I thought I'd leave the server on, and am somewhat dismayed to discover