https://wiki.bsdhowto.ru/index.php?action=history&feed=atom&title=SSHGuard 2026-04-17T14:11:51Z История изменений этой страницы в вики MediaWiki 1.43.0 https://wiki.bsdhowto.ru/index.php?title=SSHGuard&diff=143&oldid=prev 2025-07-07T09:01:49Z

<p><span class="autocomment">Пример работы SSHGuard</span></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="ru"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Предыдущая версия</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Версия от 12:01, 7 июля 2025</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l159">Строка 159:</td> <td colspan="2" class="diff-lineno">Строка 159:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # ipfw table 22 list</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # ipfw table 22 list</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  78.128.112.74/32 0</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  78.128.112.74/32 0</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">IPFW будет сообщать об атаках в файле /var/log/security:</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Jul  7 11:54:32 main kernel: ipfw: 5000 Deny TCP 78.128.112.74:44818 &lt;my IP&gt; in via re0</ins></div></td></tr> </table>

Igor https://wiki.bsdhowto.ru/index.php?title=SSHGuard&diff=142&oldid=prev 2025-07-07T08:51:38Z

<p><span class="autocomment">Контроль доступа с помощью IPFW</span></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="ru"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Предыдущая версия</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Версия от 11:51, 7 июля 2025</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l91">Строка 91:</td> <td colspan="2" class="diff-lineno">Строка 91:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # sysrc sshguard_enable=&quot;YES&quot;</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # sysrc sshguard_enable=&quot;YES&quot;</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  sshguard_enable:  -&gt; YES</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  sshguard_enable:  -&gt; YES</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">== Пример настройки SSHGuard для IPFW ==</ins></div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Установка способа ограничения доступа к сетевым сервисам с помощью IPFW в файле настройки /usr/local/etc/sshguard.conf:</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Установка способа ограничения доступа к сетевым сервисам с помощью IPFW в файле настройки /usr/local/etc/sshguard.conf:</div></td></tr> </table>

Igor https://wiki.bsdhowto.ru/index.php?title=SSHGuard&diff=141&oldid=prev 2025-07-07T08:49:02Z

<p><span class="autocomment">Контроль доступа с помощью IPFW</span></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="ru"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Предыдущая версия</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Версия от 11:49, 7 июля 2025</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l123">Строка 123:</td> <td colspan="2" class="diff-lineno">Строка 123:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>SSHGuard в соответствии с данной строкой настройки обнаруживает неудачные попытки аутентификации по SSH, зафиксированные в файле журнала /var/log/auth.log. И разбирает обращения к почтовому сервису в основной ОС, записанные в файле журнала /var/log/maillog</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>SSHGuard в соответствии с данной строкой настройки обнаруживает неудачные попытки аутентификации по SSH, зафиксированные в файле журнала /var/log/auth.log. И разбирает обращения к почтовому сервису в основной ОС, записанные в файле журнала /var/log/maillog</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Пример работы SSHGuard<del style="font-weight: bold; text-decoration: none;">. Он проверяет содержимое файла /var/log/auth.log:</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">== </ins>Пример работы SSHGuard <ins style="font-weight: bold; text-decoration: none;">==</ins></div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:48:00 main sshd[1093]: error: maximum authentication attempts exceeded for root from 151.177.150.97 port 44990 ssh2 [preauth]</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:48:00 main sshd[1093]: Disconnecting authenticating user root 151.177.150.97 port 44990: Too many authentication failures [preauth]</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:48:02 main sshd[1095]: error: maximum authentication attempts exceeded for root from 151.177.150.97 port 45172 ssh2 [preauth]</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:48:02 main sshguard[800]: Attack from "151.177.150.97" on service SSH with danger 10.</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:48:02 main sshd[1095]: Disconnecting authenticating user root 151.177.150.97 port 45172: Too many authentication failures [preauth]</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:48:03 main sshd[1097]: error: maximum authentication attempts exceeded for root from 151.177.150.97 port 45402 ssh2 [preauth]</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:48:03 main sshguard[800]: Attack from "151.177.150.97" on service SSH with danger 10.</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:48:03 main sshd[1097]: Disconnecting authenticating user root 151.177.150.97 port 45402: Too many authentication failures [preauth]</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:48:04 main sshd[1099]: Received disconnect from 151.177.150.97 port 45540:11: disconnected by user [preauth]</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:48:04 main sshd[1099]: Disconnected from authenticating user root 151.177.150.97 port 45540 [preauth]</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:48:04 main sshguard[800]: Attack from "151.177.150.97" on service SSH with danger 10.</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:48:04 main sshguard[800]: Blocking "151.177.150.97/32" for 120 secs (3 attacks in 2 secs, after 1 abuses over 2 secs.)</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:49:53 main sshd[1102]: Invalid user admin from 45.135.193.100 port 40608</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:49:53 main sshguard[800]: Attack from "45.135.193.100" on service SSH with danger 10.</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:49:53 main sshd[1102]: Connection closed by invalid user admin 45.135.193.100 port 40608 [preauth]</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:49:53 main sshguard[800]: Attack from "45.135.193.100" on service SSH with danger 2.</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:50:30 main sshguard[800]: 151.177.150.97: unblocking after 146 secs</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">После достижения определённого количества атак IP-адрес блокируется на 120 секунд (время блокировок настраивается в файле </del>/<del style="font-weight: bold; text-decoration: none;">usr</del>/<del style="font-weight: bold; text-decoration: none;">local/etc</del>/sshguard.<del style="font-weight: bold; text-decoration: none;">conf)</del>:</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">SSHGuard проверяет содержимое файла </ins>/<ins style="font-weight: bold; text-decoration: none;">var</ins>/<ins style="font-weight: bold; text-decoration: none;">log</ins>/<ins style="font-weight: bold; text-decoration: none;">auth.log:</ins></div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>  <del style="font-weight: bold; text-decoration: none;"># less auth</del>.<del style="font-weight: bold; text-decoration: none;">log | grep Blocking</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Jul  6 18:48:20 main sshd[18686]: Invalid user admin from 78.128.112.74 port 34208</ins></div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>  <del style="font-weight: bold; text-decoration: none;">Apr 13 13</del>:<del style="font-weight: bold; text-decoration: none;">48</del>:<del style="font-weight: bold; text-decoration: none;">04 </del>main sshguard[<del style="font-weight: bold; text-decoration: none;">800</del>]: Blocking "<del style="font-weight: bold; text-decoration: none;">151</del>.<del style="font-weight: bold; text-decoration: none;">177</del>.<del style="font-weight: bold; text-decoration: none;">150</del>.<del style="font-weight: bold; text-decoration: none;">97</del>/32" for <del style="font-weight: bold; text-decoration: none;">120 </del>secs (3 attacks in <del style="font-weight: bold; text-decoration: none;">2 </del>secs, after <del style="font-weight: bold; text-decoration: none;">1 </del>abuses over <del style="font-weight: bold; text-decoration: none;">2 </del>secs.)</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Jul  6 18:48:20 main sshguard[5287]: Attack from "78.128.112.74" on service SSH with danger 10.</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Jul  6 18:48:20 main sshd[18686]: Connection closed by invalid user admin 78.128.112.74 port 34208 [preauth]</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Jul  6 18:48:20 main </ins>sshguard<ins style="font-weight: bold; text-decoration: none;">[5287]: Attack from "78.128.112.74" on service SSH with danger 2.</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Jul  6 20:57:25 main sshd[19310]: reverse mapping checking getaddrinfo for ip-112-74</ins>.<ins style="font-weight: bold; text-decoration: none;">4vendeta.com [78.128.112.74] failed.</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Jul  6 20:57:26 main sshd[19310]</ins>: <ins style="font-weight: bold; text-decoration: none;">Invalid user admin from 78.128.112.74 port 36742</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>  <ins style="font-weight: bold; text-decoration: none;">Jul  6 20:57:26 main sshguard[5287]: Attack from "78.128.112.74" on service SSH with danger 10</ins>.</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>  <ins style="font-weight: bold; text-decoration: none;">Jul  6 20</ins>:<ins style="font-weight: bold; text-decoration: none;">57</ins>:<ins style="font-weight: bold; text-decoration: none;">26 </ins>main sshguard[<ins style="font-weight: bold; text-decoration: none;">5287</ins>]: Blocking "<ins style="font-weight: bold; text-decoration: none;">78</ins>.<ins style="font-weight: bold; text-decoration: none;">128</ins>.<ins style="font-weight: bold; text-decoration: none;">112</ins>.<ins style="font-weight: bold; text-decoration: none;">74</ins>/32" for <ins style="font-weight: bold; text-decoration: none;">960 </ins>secs (3 attacks in <ins style="font-weight: bold; text-decoration: none;">7746 </ins>secs, after <ins style="font-weight: bold; text-decoration: none;">5 </ins>abuses over <ins style="font-weight: bold; text-decoration: none;">69267 </ins>secs.)</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Jul  6 21:13:27 main sshguard[5287]: 78.128.112.74: unblocking after 961 secs</ins></div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">Реабилитация и разблокировка удалённого пользователя через определённый промежуток времени</del>, <del style="font-weight: bold; text-decoration: none;">если </del>он <del style="font-weight: bold; text-decoration: none;">случайно неправильно вводил неправильные учётные данные:</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">Из файла журнала видно, что SSHGuard считает количество зафиксированных опасностей (danger 10+2+10=22). И при превышении порогового значения, указанного в параметре THRESHOLD файла настройки /usr/local/etc/sshguard.conf, вносит IP злодея в таблицу "22"</ins>, <ins style="font-weight: bold; text-decoration: none;">после чего </ins>он <ins style="font-weight: bold; text-decoration: none;">блокируется IPFW. В данном случае был THRESHOLD=20</ins>. <ins style="font-weight: bold; text-decoration: none;">По умолчанию - THRESHOLD=</ins>30<ins style="font-weight: bold; text-decoration: none;">. Т.к. порог количества блокировок не был достигнут, то блокировка временная. В данном случае на 960 секунд. Начальное время блокировки устанавливается параметром BLOCK_TIME файла настройки /usr/local/etc/</ins>sshguard.<ins style="font-weight: bold; text-decoration: none;">conf. Время каждой последующей блокировки увеличивается</ins>. <ins style="font-weight: bold; text-decoration: none;">По прошествии времени IP разблокируется</ins>.</div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> # less auth</del>.<del style="font-weight: bold; text-decoration: none;">log | grep unblocking</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 13:50:</del>30 <del style="font-weight: bold; text-decoration: none;">main </del>sshguard<del style="font-weight: bold; text-decoration: none;">[800]: 151</del>.<del style="font-weight: bold; text-decoration: none;">177</del>.<del style="font-weight: bold; text-decoration: none;">150</del>.<del style="font-weight: bold; text-decoration: none;">97: unblocking after 146 secs</del></div></td><td colspan="2" class="diff-side-added"></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">Дальнейшая логика SSHGuard состоит в блокировке очередного IP</del>-<del style="font-weight: bold; text-decoration: none;">адреса на 120, 240 и 480 секунд (время блокировок настраивается в файле /usr/local/etc/sshguard</del>.<del style="font-weight: bold; text-decoration: none;">conf):</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Jul  6 23:05:20 main sshd[22673]: reverse mapping checking getaddrinfo for ip-112</ins>-<ins style="font-weight: bold; text-decoration: none;">74.4vendeta.com [78.128.112.74] failed</ins>.</div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>  <del style="font-weight: bold; text-decoration: none;"># less auth</del>.<del style="font-weight: bold; text-decoration: none;">log | grep Blocking</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>  <ins style="font-weight: bold; text-decoration: none;">Jul  6 23:05:20 main sshd[22673]: Invalid user admin from 78.128.112</ins>.<ins style="font-weight: bold; text-decoration: none;">74 port 58474</ins></div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>  <del style="font-weight: bold; text-decoration: none;">Apr 13 13</del>:<del style="font-weight: bold; text-decoration: none;">48</del>:<del style="font-weight: bold; text-decoration: none;">04 </del>main sshguard[<del style="font-weight: bold; text-decoration: none;">800</del>]: <del style="font-weight: bold; text-decoration: none;">Blocking </del>"<del style="font-weight: bold; text-decoration: none;">151</del>.<del style="font-weight: bold; text-decoration: none;">177</del>.<del style="font-weight: bold; text-decoration: none;">150</del>.<del style="font-weight: bold; text-decoration: none;">97/32</del>" <del style="font-weight: bold; text-decoration: none;">for 120 secs (3 attacks in 2 secs, after 1 abuses over 2 secs</del>.<del style="font-weight: bold; text-decoration: none;">)</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>  <ins style="font-weight: bold; text-decoration: none;">Jul  6 23</ins>:<ins style="font-weight: bold; text-decoration: none;">05</ins>:<ins style="font-weight: bold; text-decoration: none;">20 </ins>main sshguard[<ins style="font-weight: bold; text-decoration: none;">5287</ins>]: <ins style="font-weight: bold; text-decoration: none;">Attack from </ins>"<ins style="font-weight: bold; text-decoration: none;">78</ins>.<ins style="font-weight: bold; text-decoration: none;">128</ins>.<ins style="font-weight: bold; text-decoration: none;">112</ins>.<ins style="font-weight: bold; text-decoration: none;">74</ins>" <ins style="font-weight: bold; text-decoration: none;">on service SSH with danger 10.</ins></div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>  <del style="font-weight: bold; text-decoration: none;">Apr 13 14</del>:<del style="font-weight: bold; text-decoration: none;">07</del>:<del style="font-weight: bold; text-decoration: none;">14 </del>main sshguard[<del style="font-weight: bold; text-decoration: none;">800</del>]: <del style="font-weight: bold; text-decoration: none;">Blocking </del>"<del style="font-weight: bold; text-decoration: none;">81</del>.<del style="font-weight: bold; text-decoration: none;">17</del>.<del style="font-weight: bold; text-decoration: none;">25</del>.<del style="font-weight: bold; text-decoration: none;">50/32</del>" for <del style="font-weight: bold; text-decoration: none;">120 secs (3 attacks in 1 secs, after 1 abuses over 1 secs</del>.<del style="font-weight: bold; text-decoration: none;">)</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Jul  6 23:05:20 main sshd[22673]: Connection closed by invalid user admin 78.128.112</ins>.<ins style="font-weight: bold; text-decoration: none;">74 port 58474 [preauth]</ins></div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>  <del style="font-weight: bold; text-decoration: none;">Apr 13 14</del>:<del style="font-weight: bold; text-decoration: none;">10</del>:<del style="font-weight: bold; text-decoration: none;">02 </del>main sshguard[<del style="font-weight: bold; text-decoration: none;">800</del>]: <del style="font-weight: bold; text-decoration: none;">Blocking </del>"<del style="font-weight: bold; text-decoration: none;">81</del>.<del style="font-weight: bold; text-decoration: none;">17</del>.<del style="font-weight: bold; text-decoration: none;">25</del>.<del style="font-weight: bold; text-decoration: none;">50/32</del>" <del style="font-weight: bold; text-decoration: none;">for 240 secs (3 attacks in 2 secs, after 2 abuses over 169 secs</del>.<del style="font-weight: bold; text-decoration: none;">)</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>  <ins style="font-weight: bold; text-decoration: none;">Jul  6 23</ins>:<ins style="font-weight: bold; text-decoration: none;">05</ins>:<ins style="font-weight: bold; text-decoration: none;">20 </ins>main sshguard[<ins style="font-weight: bold; text-decoration: none;">5287</ins>]: <ins style="font-weight: bold; text-decoration: none;">Attack from </ins>"<ins style="font-weight: bold; text-decoration: none;">78</ins>.<ins style="font-weight: bold; text-decoration: none;">128</ins>.<ins style="font-weight: bold; text-decoration: none;">112</ins>.<ins style="font-weight: bold; text-decoration: none;">74</ins>" <ins style="font-weight: bold; text-decoration: none;">on service SSH with danger 2.</ins></div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>  <del style="font-weight: bold; text-decoration: none;">Apr 13 14</del>:<del style="font-weight: bold; text-decoration: none;">14</del>:<del style="font-weight: bold; text-decoration: none;">35 </del>main sshguard[<del style="font-weight: bold; text-decoration: none;">800</del>]: Blocking "<del style="font-weight: bold; text-decoration: none;">81</del>.<del style="font-weight: bold; text-decoration: none;">17</del>.<del style="font-weight: bold; text-decoration: none;">25</del>.<del style="font-weight: bold; text-decoration: none;">50</del>/32" <del style="font-weight: bold; text-decoration: none;">for 480 secs </del>(3 attacks in <del style="font-weight: bold; text-decoration: none;">1 </del>secs, after <del style="font-weight: bold; text-decoration: none;">3 </del>abuses over <del style="font-weight: bold; text-decoration: none;">442 </del>secs.)</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Jul  7 01:12:20 main sshd[23322]: reverse mapping checking getaddrinfo </ins>for <ins style="font-weight: bold; text-decoration: none;">ip-112-74.4vendeta.com [78.128.112.74] failed.</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Jul  7 01:12:20 main sshd[23322]: Invalid user admin from 78.128.112</ins>.<ins style="font-weight: bold; text-decoration: none;">74 port 32880</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>  <ins style="font-weight: bold; text-decoration: none;">Jul  7 01</ins>:<ins style="font-weight: bold; text-decoration: none;">12</ins>:<ins style="font-weight: bold; text-decoration: none;">20 </ins>main sshguard[<ins style="font-weight: bold; text-decoration: none;">5287</ins>]: <ins style="font-weight: bold; text-decoration: none;">Attack from </ins>"<ins style="font-weight: bold; text-decoration: none;">78</ins>.<ins style="font-weight: bold; text-decoration: none;">128</ins>.<ins style="font-weight: bold; text-decoration: none;">112</ins>.<ins style="font-weight: bold; text-decoration: none;">74</ins>" <ins style="font-weight: bold; text-decoration: none;">on service SSH with danger 10</ins>.</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>  <ins style="font-weight: bold; text-decoration: none;">Jul  7 01</ins>:<ins style="font-weight: bold; text-decoration: none;">12</ins>:<ins style="font-weight: bold; text-decoration: none;">20 </ins>main sshguard[<ins style="font-weight: bold; text-decoration: none;">5287</ins>]: Blocking "<ins style="font-weight: bold; text-decoration: none;">78</ins>.<ins style="font-weight: bold; text-decoration: none;">128</ins>.<ins style="font-weight: bold; text-decoration: none;">112</ins>.<ins style="font-weight: bold; text-decoration: none;">74</ins>/32" <ins style="font-weight: bold; text-decoration: none;">forever </ins>(3 attacks in <ins style="font-weight: bold; text-decoration: none;">7620 </ins>secs, after <ins style="font-weight: bold; text-decoration: none;">6 </ins>abuses over <ins style="font-weight: bold; text-decoration: none;">84561 </ins>secs.)</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;">Т</del>.<del style="font-weight: bold; text-decoration: none;">к. с этого адреса прекратились атаки, он </del>так<del style="font-weight: bold; text-decoration: none;">-же пока разблокирован</del>:</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">В данном случае после достижения порога количества блокировок SSHGuard блокирует IP навсегда (forever)</ins>.</div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>  # less <del style="font-weight: bold; text-decoration: none;">auth</del>.<del style="font-weight: bold; text-decoration: none;">log | grep unblocking</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>  <del style="font-weight: bold; text-decoration: none;">Apr 13 13:50:30 main sshguard[800]: 151</del>.<del style="font-weight: bold; text-decoration: none;">177</del>.<del style="font-weight: bold; text-decoration: none;">150</del>.<del style="font-weight: bold; text-decoration: none;">97: unblocking after 146 secs</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">Проверить это можно </ins>так:</div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del style="font-weight: bold; text-decoration: none;"> Apr 13 14</del>:<del style="font-weight: bold; text-decoration: none;">09:55 main sshguard[800]: 81.17.25.50: unblocking after 161 secs</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>  # less <ins style="font-weight: bold; text-decoration: none;">/var/db/sshguard/blacklist</ins>.<ins style="font-weight: bold; text-decoration: none;">db</ins></div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>  <del style="font-weight: bold; text-decoration: none;">Apr 13 14:14:32 main sshguard[800]: 81.17.25.50: unblocking after 270 secs</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>  <ins style="font-weight: bold; text-decoration: none;">1751839940|100|4|78</ins>.<ins style="font-weight: bold; text-decoration: none;">128</ins>.<ins style="font-weight: bold; text-decoration: none;">112</ins>.<ins style="font-weight: bold; text-decoration: none;">74</ins></div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>  <del style="font-weight: bold; text-decoration: none;">Apr 13 14:22:54 main sshguard[800]: 81</del>.<del style="font-weight: bold; text-decoration: none;">17</del>.<del style="font-weight: bold; text-decoration: none;">25</del>.<del style="font-weight: bold; text-decoration: none;">50: unblocking after 499 secs</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">Теперь после каждого старта SSHGuard будет добавлять IP из данного чёрного списка в таблицу "22", не дожидаясь атак</ins>:</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>  <ins style="font-weight: bold; text-decoration: none;"># ipfw table 22 list</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>  <ins style="font-weight: bold; text-decoration: none;">78</ins>.<ins style="font-weight: bold; text-decoration: none;">128</ins>.<ins style="font-weight: bold; text-decoration: none;">112</ins>.<ins style="font-weight: bold; text-decoration: none;">74/32 0</ins></div></td></tr> </table>

Igor https://wiki.bsdhowto.ru/index.php?title=SSHGuard&diff=75&oldid=prev 2025-05-01T15:08:44Z

<p><span class="autocomment">Контроль доступа с помощью IPFW</span></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="ru"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Предыдущая версия</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Версия от 18:08, 1 мая 2025</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l115">Строка 115:</td> <td colspan="2" class="diff-lineno">Строка 115:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Добавление запрещающего правила на основе таблицы &quot;22&quot; IPFW в автозапуск с помощью /etc/rc.local:</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Добавление запрещающего правила на основе таблицы &quot;22&quot; IPFW в автозапуск с помощью /etc/rc.local:</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  #!/bin/sh</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  #!/bin/sh</div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>  ipfw add 5000 deny <del style="font-weight: bold; text-decoration: none;">ip </del>from table\(22\) to any</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>  ipfw add 5000 deny <ins style="font-weight: bold; text-decoration: none;">log all </ins>from table\(22\) to any</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>SSHGuard, установленный из пакета проверяет два файла:</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>SSHGuard, установленный из пакета проверяет два файла:</div></td></tr> </table>

Igor https://wiki.bsdhowto.ru/index.php?title=SSHGuard&diff=24&oldid=prev 2025-04-27T18:19:05Z

<p><span class="autocomment">Контроль доступа с помощью IPFW</span></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="ru"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Предыдущая версия</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Версия от 21:19, 27 апреля 2025</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l69">Строка 69:</td> <td colspan="2" class="diff-lineno">Строка 69:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Символ &quot;&amp;&quot; в данном случае необходим. Без него будет добавлено единственное правило IPFW, запрещающее весь трафик, и дальнейшее выполнение скрипта запуска IPFW будет прекращено (в случае удалённого управления, например по SSH).</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Символ &quot;&amp;&quot; в данном случае необходим. Без него будет добавлено единственное правило IPFW, запрещающее весь трафик, и дальнейшее выполнение скрипта запуска IPFW будет прекращено (в случае удалённого управления, например по SSH).</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Проверка на консоли:</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Проверка на консоли <ins style="font-weight: bold; text-decoration: none;">результата запуска IPFW без "&amp;". Добавлено одно запрещающее правило</ins>:</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # ipfw show</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # ipfw show</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  65535  4  400 deny ip from any to any</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  65535  4  400 deny ip from any to any</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Правильный запуск прервёт текущий сеанс SSH, но выполнение запуска IPFW будет продолжено:</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Правильный запуск прервёт текущий сеанс SSH, но выполнение запуска IPFW будет продолжено<ins style="font-weight: bold; text-decoration: none;">. Перед запрещающим весь трафик правилом добавлено разрешающее правило с номером "65000" и несколько других правил</ins>:</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # ipfw show</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # ipfw show</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  00100  0    0 allow ip from any to any via lo0</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  00100  0    0 allow ip from any to any via lo0</div></td></tr> </table>

Igor https://wiki.bsdhowto.ru/index.php?title=SSHGuard&diff=19&oldid=prev 2025-04-13T11:40:40Z

<p><span class="autocomment">Контроль доступа с помощью IPFW</span></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="ru"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Предыдущая версия</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Версия от 14:40, 13 апреля 2025</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l142">Строка 142:</td> <td colspan="2" class="diff-lineno">Строка 142:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:50:30 main sshguard[800]: 151.177.150.97: unblocking after 146 secs</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:50:30 main sshguard[800]: 151.177.150.97: unblocking after 146 secs</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>После достижения определённого количества атак IP-адрес блокируется на 120 секунд (настраивается в файле /usr/local/etc/sshguard.conf):</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>После достижения определённого количества атак IP-адрес блокируется на 120 секунд (<ins style="font-weight: bold; text-decoration: none;">время блокировок </ins>настраивается в файле /usr/local/etc/sshguard.conf):</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # less auth.log | grep Blocking</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # less auth.log | grep Blocking</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:48:04 main sshguard[800]: Blocking &quot;151.177.150.97/32&quot; for 120 secs (3 attacks in 2 secs, after 1 abuses over 2 secs.)</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:48:04 main sshguard[800]: Blocking &quot;151.177.150.97/32&quot; for 120 secs (3 attacks in 2 secs, after 1 abuses over 2 secs.)</div></td></tr> <tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l150">Строка 150:</td> <td colspan="2" class="diff-lineno">Строка 150:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:50:30 main sshguard[800]: 151.177.150.97: unblocking after 146 secs</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:50:30 main sshguard[800]: 151.177.150.97: unblocking after 146 secs</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Дальнейшая логика SSHGuard состоит в блокировке очередного IP-адреса на 120, 240 и 480 секунд:</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Дальнейшая логика SSHGuard состоит в блокировке очередного IP-адреса на 120, 240 и 480 секунд <ins style="font-weight: bold; text-decoration: none;">(время блокировок настраивается в файле /usr/local/etc/sshguard.conf)</ins>:</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # less auth.log | grep Blocking</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # less auth.log | grep Blocking</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:48:04 main sshguard[800]: Blocking &quot;151.177.150.97/32&quot; for 120 secs (3 attacks in 2 secs, after 1 abuses over 2 secs.)</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:48:04 main sshguard[800]: Blocking &quot;151.177.150.97/32&quot; for 120 secs (3 attacks in 2 secs, after 1 abuses over 2 secs.)</div></td></tr> </table>

Igor https://wiki.bsdhowto.ru/index.php?title=SSHGuard&diff=18&oldid=prev 2025-04-13T11:36:37Z

<p><span class="autocomment">Контроль доступа с помощью IPFW</span></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="ru"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Предыдущая версия</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Версия от 14:36, 13 апреля 2025</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l156">Строка 156:</td> <td colspan="2" class="diff-lineno">Строка 156:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 14:10:02 main sshguard[800]: Blocking &quot;81.17.25.50/32&quot; for 240 secs (3 attacks in 2 secs, after 2 abuses over 169 secs.)</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 14:10:02 main sshguard[800]: Blocking &quot;81.17.25.50/32&quot; for 240 secs (3 attacks in 2 secs, after 2 abuses over 169 secs.)</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 14:14:35 main sshguard[800]: Blocking &quot;81.17.25.50/32&quot; for 480 secs (3 attacks in 1 secs, after 3 abuses over 442 secs.)</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 14:14:35 main sshguard[800]: Blocking &quot;81.17.25.50/32&quot; for 480 secs (3 attacks in 1 secs, after 3 abuses over 442 secs.)</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">Т.к. с этого адреса прекратились атаки, он так-же пока разблокирован:</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> # less auth.log | grep unblocking</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Apr 13 13:50:30 main sshguard[800]: 151.177.150.97: unblocking after 146 secs</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Apr 13 14:09:55 main sshguard[800]: 81.17.25.50: unblocking after 161 secs</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Apr 13 14:14:32 main sshguard[800]: 81.17.25.50: unblocking after 270 secs</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Apr 13 14:22:54 main sshguard[800]: 81.17.25.50: unblocking after 499 secs</ins></div></td></tr> </table>

Igor https://wiki.bsdhowto.ru/index.php?title=SSHGuard&diff=17&oldid=prev 2025-04-13T11:27:59Z

<p><span class="autocomment">Контроль доступа с помощью IPFW</span></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="ru"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Предыдущая версия</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Версия от 14:27, 13 апреля 2025</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l149">Строка 149:</td> <td colspan="2" class="diff-lineno">Строка 149:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # less auth.log | grep unblocking</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # less auth.log | grep unblocking</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:50:30 main sshguard[800]: 151.177.150.97: unblocking after 146 secs</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:50:30 main sshguard[800]: 151.177.150.97: unblocking after 146 secs</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">Дальнейшая логика SSHGuard состоит в блокировке очередного IP-адреса на 120, 240 и 480 секунд:</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> # less auth.log | grep Blocking</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Apr 13 13:48:04 main sshguard[800]: Blocking "151.177.150.97/32" for 120 secs (3 attacks in 2 secs, after 1 abuses over 2 secs.)</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Apr 13 14:07:14 main sshguard[800]: Blocking "81.17.25.50/32" for 120 secs (3 attacks in 1 secs, after 1 abuses over 1 secs.)</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Apr 13 14:10:02 main sshguard[800]: Blocking "81.17.25.50/32" for 240 secs (3 attacks in 2 secs, after 2 abuses over 169 secs.)</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Apr 13 14:14:35 main sshguard[800]: Blocking "81.17.25.50/32" for 480 secs (3 attacks in 1 secs, after 3 abuses over 442 secs.)</ins></div></td></tr> </table>

Igor https://wiki.bsdhowto.ru/index.php?title=SSHGuard&diff=16&oldid=prev 2025-04-13T11:21:22Z

<p><span class="autocomment">Контроль доступа с помощью IPFW</span></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="ru"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Предыдущая версия</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Версия от 14:21, 13 апреля 2025</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l142">Строка 142:</td> <td colspan="2" class="diff-lineno">Строка 142:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:50:30 main sshguard[800]: 151.177.150.97: unblocking after 146 secs</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:50:30 main sshguard[800]: 151.177.150.97: unblocking after 146 secs</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>После достижения определённого количества атак IP-адрес блокируется:</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>После достижения определённого количества атак IP-адрес блокируется <ins style="font-weight: bold; text-decoration: none;">на 120 секунд (настраивается в файле /usr/local/etc/sshguard.conf)</ins>:</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # less auth.log | grep Blocking</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  # less auth.log | grep Blocking</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:48:04 main sshguard[800]: Blocking &quot;151.177.150.97/32&quot; for 120 secs (3 attacks in 2 secs, after 1 abuses over 2 secs.)</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:48:04 main sshguard[800]: Blocking &quot;151.177.150.97/32&quot; for 120 secs (3 attacks in 2 secs, after 1 abuses over 2 secs.)</div></td></tr> </table>

Igor https://wiki.bsdhowto.ru/index.php?title=SSHGuard&diff=15&oldid=prev 2025-04-13T11:17:50Z

<p><span class="autocomment">Контроль доступа с помощью IPFW</span></p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="ru"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Предыдущая версия</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Версия от 14:17, 13 апреля 2025</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l140">Строка 140:</td> <td colspan="2" class="diff-lineno">Строка 140:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:49:53 main sshd[1102]: Connection closed by invalid user admin 45.135.193.100 port 40608 [preauth]</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:49:53 main sshd[1102]: Connection closed by invalid user admin 45.135.193.100 port 40608 [preauth]</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:49:53 main sshguard[800]: Attack from &quot;45.135.193.100&quot; on service SSH with danger 2.</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:49:53 main sshguard[800]: Attack from &quot;45.135.193.100&quot; on service SSH with danger 2.</div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Apr 13 13:50:30 main sshguard[800]: 151.177.150.97: unblocking after 146 secs</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">После достижения определённого количества атак IP-адрес блокируется:</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> # less auth.log | grep Blocking</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> Apr 13 13:48:04 main sshguard[800]: Blocking "151.177.150.97/32" for 120 secs (3 attacks in 2 secs, after 1 abuses over 2 secs.)</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"></ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;">Реабилитация и разблокировка удалённого пользователя через определённый промежуток времени, если он случайно неправильно вводил неправильные учётные данные:</ins></div></td></tr> <tr><td colspan="2" class="diff-side-deleted"></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins style="font-weight: bold; text-decoration: none;"> # less auth.log | grep unblocking</ins></div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:50:30 main sshguard[800]: 151.177.150.97: unblocking after 146 secs</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  Apr 13 13:50:30 main sshguard[800]: 151.177.150.97: unblocking after 146 secs</div></td></tr> </table>

Igor