Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

From the FreeBSD handbook:

Even with the logging facility enabled, IPFW will not generate any rule logging on its own. The firewall administrator decides which rules in the ruleset will be logged, and adds the log keyword to those rules.

So my question is, should I enable logging to any rules for IPFW for sshguard-ipfw to work and be able to blacklist IP's?

I only have rules allowing SSH in and out on 22. It would only make sense to log deny rules. Pam authentication errors for SSH should be enough information for sshguard-ipfw to block and blacklist IP's?

According to sshguard's website you can use it even without a firewall, so I'm guessing the logs for ipfw don't matter.

Before someone says this in the answers to enable blacklisting add this to syslog.conf auth.info;authpriv.info |/usr/local/sbin/sshguard -10:/var/db/sshguard/blacklist.db

Thanks.

share|improve this question

1 Answer 1

Logging is open to choice and I will explain why. It is easier to block ALL (drop, not reject) and allow in ONLY trusted addresses. This allows you to make ONE rule versus N amount of rules you'd be generating by blacklisting. Have a look at the average blacklist and you will find that there can be well over the 1k mark on any given day. What occurs is the following:

Firewall (be if IPFW, IPTables, a Checkpoint FW, SSG, etc.):

Connection is coming in --> Check against the first rule
Connection is coming in --> Check against the second rule
Connection is coming in --> Check against the ... rule

Your machine will have to process N amount of rules - where N is the amount of IP addresses in your blacklist. Not to mention, I know of ssh-based bots which spoof addresses, so there is also the possibility of spoofing: the machine itself, the default route... 0.0.0.0/0 (everyone). Think about that for a moment. If I did the following:

nmap -sS YOUR.IP.ADDRESS -p 80 -D 0.0.0.0,YOURGATEWAYIP,YOURUPSTREAMGWIP

Your logs will show entries from 0.0.0.0, Your Gateway IP, Your Upstream GW IP, in turn creating a FW rule to block connections. To avoid this, you'd have to WHITELIST IP address, creating even more rules:

Connection is coming in --> Check against the first rule --> WHITELISTED

This packet will be sent immediately depending on the placement of the rule (it would have to be one of the first. Otherwise:

Connection is coming in --> Check against the first rule
Connection is coming in --> Check against the second rule
Connection is coming in --> Check against the ... rule
Connection is coming in --> Check against the first rule --> WHITELISTED

The bigger your rules become, the harder it is to maintain. If at all possible, its better to do the following:

firewall --> this Whitelisted address is allowed all others blocked

One rule to process versus cumbersome rules. Now, back to logging; what would be the goal of logging. Attacks come, attacks go. The Internet is like outerspace filled with junk. Many of the ssh attacks are coming from compromised hosts, not the actual attacker. Many are parts of botnets, some of which are 100's of thousands strong. Not only are you wasting processing power, eventually, you are also wasting space on the drives since logs can grow.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.