On Aug 5, 2026, at 6:07 PM, George Rosamond <[email protected]> wrote: > > Note jpb will be remote, but there will be people watching at the Brass > Monkey > > ** > > VIDAR - Server Protection for Internet facing FreeBSD Servers, Jim Brown > 2026-08-05 @ 18:45 local (22:45 UTC) - Backroom of Brass Monkey 55 > Little West 12th St > > Vidar is a combination of programs, a PostgreSQL database, and the SEC > correlator engine that reads logfiles from authentication, email > (postfix), and web server (nginx), (and potentially any other logs) and > takes action based on SEC rules to add e ntries to an IPFW firewall. In > concept it is similar to fail2ban and has some features in common with > blocklistd. >
Hey this sounds great. I like the idea of simplicity in that it sec that fits it all together generally . Correlations in time is mechanism for the start of the most transaction. Just kidding around but what about a grey listed database in the spirit of spamd such that certain ips are considered tainted and grey listed among the good guys , then you could bump the interval the badder the offender — more spurious hits across more sites .. higher correlations ~ then the snowball might melt .. of course you might have some problems with malicious use of that feature !!! Haha .. the future is time .. miss the nycbug studs, Cheers James Ps Running /usr/games/factor $( date +%s ) on OpenBSD is fun .. remove the new line and the let the stuff scroll .. zoom it out by decreasing yo font size .. over rover . > SEC reads the logs in real time and based on its rules and correlations, > outputs metadata that is piped to a process that inserts the events into > a PostgreSQL database and further pipes the offending IP address to a > script that updates a table named “BAD” in IPFW. This table is read by > IPFW rules to block offending external systems from wreaking havoc on a > FreeBSD host. > > A corresponding table named GOOD contains whitelisted IP addresses so > you don’t accidentally lock yourself out. > > <RANT> > > Are you sick and tired of seeing: > > 2a03:b0c0:3:d0::402:d001 - - [31/Jan/2026:17:37:17 -0500] > \x16\x03\x01\x05\xDE\x01 ... > > in your nginx logs and sick of seeing: > > Feb 20 16:36:03 jimby dovecot[59472]: imap-login: Disconnected: > Connection closed (no auth attempts in 5 secs): user=<>, > rip=206.168.34.125, lip=174.136.97.66, TLS: Connection closed, ... > > in your mail logs and sick of seeing: > > Feb 20 12:47:58 jimby sshd-session[47730]: Invalid user zzzz from > 2607:f170:44:12::5d0 port 520 > > in your authentication logs? > > With Vidar, you get to put the hammer down: > > “If you abuse my system, I will shut you out. Permanently.” > > </RANT> > > Vidar has additional tricks - a way to dump the IPFW BAD table and a way > to import it later - you can keep this database of shame up to date on > all those miscreants and keep them away. You can even import the BAD > table on another FreeBSD system running IPFW. Also, there’s a handy > audit script that lets you compare the entries in the database with what > is actually in the IPFW BAD table. Also, Vidar keeps the evidence of the > event in question that resulted in blocked access. Finally, using SEC > rules, you can make the block last for an hour (for a misconfigured > remote system) or a day (for a script kiddie), or permanently (for a > determined hacker), or any length of time you choose. > > There is also a feature to check live processes and alert if, for > example, the vi editor is running at 2:00am in the morning. > > Jim Brown is a long time BSD aficionado who currently lives in Durham, NC. > > Nearest NYC Subway is the 14th Street/Eighth Avenue station L, A, C, E. > > To get to the backroom, you must enter the front door, follow the long > bar on your left, and walk all the way to the back. At the rear of the > BrassMonkey, you will see an alcove for the 3 bathrooms our room is off > to your right.
