"SfR Fresh" - the SfR Freeware/Shareware Archive

Member "blocksshd-1.3/README" of archive blocksshd-1.3.tar.gz:

    1 
    2 BlockSSHD v1.1
    3 
    4 BlockSSHD is a Perl script based on BruteForceBlocker v1.2.3 that dynamically 
    5 adds IPTables rules for Linux and pf firewall rules for BSD that block SSH 
    6 brute force attacks.  It can also detect ProFTPd login failures.
    7 
    8 BlockSSHD checks a log file you specify, for example /var/log/secure on a Red 
    9 Hat, for SSH login failure messages.  If it detects a failure message it 
   10 records the source IP address and starts a counter.  If messages continue to be
   11 detected from the same source IP address the counter is incremented for each 
   12 message.  When the counter reaches a user-specified threshold then the script
   13 will add a firewall rule blocking SSH connections from that source IP address.
   14 A user-specified time-out is also defined to trigger a reset of the counter. If
   15 the counter is incremented but has not yet reached the blocking threshold and a
   16 new login failure message arrives then BlockSSHD checks the time-out.  If the 
   17 last increment of the counter occurred earlier than the current time minus the 
   18 time-out period then the counter is reset rather than incremented.  The time-out
   19 defaults to 600 seconds (10 minutes).
   20 
   21 The BlockSSHD script can also unblock IP address after a period.  This is 
   22 enabled in the blocksshd.conf configuration file using the unblock option and 
   23 with the period set using the unblock_timeout option.
   24 
   25 The BlockSSHD script can also log the IP addresses blocked to a file.  This logging
   26 allows you to re-apply these blocked IP addresses if the host or scrip is re-started.
   27 This allows you to restore previously blocked IP addresses.  The log file is not a 
   28 complete record of all IP addresses blocked but merely aids in re-applying already 
   29 blocked IP addresses - it only logs IP addresses if the restore_blocked option in the 
   30 configuration file is set to 1. 
   31 
   32 If you have both the unblock function and the re-block function enabled then when the 
   33 IP address is unblocked it will also be removed from the log file.
   34  
   35 The BlockSSHD script has some command line options:
   36 
   37 *) -d | --daemon | --start  - Runs the script as a daemon
   38 *) --stop                   - Stops the script
   39 *) -h | --help              - Prints help text
   40 *) -v | --version           - Print the version
   41 
   42 Running the BlockSSHD script without any command line options will start it 
   43 interactively.  If you are having issues with blocksshd you can use the interactive 
   44 mode to debug it.  Another useful debugging option is to run blocksshd like so:
   45 
   46 # tail -f /file/blocksshd/logs/to | grep -i blocksshd
   47 
   48 You will also find a Red Hat style init script in the init directory.
   49 
   50 For installation instructions see the INSTALL file.
   51 
   52 Please feel free to email me with any issues - james@hardening-linux.com
   53 
   54 Copyright 2006, James Turnbull
   55 Support for pf and whois added by Anton - valqk@webreality.org - http://www.webreality.org
   56 Support for subnets in the whitelist added by Lester Hightower - hightowe@10east.com - http://www.10east.com/
   57 
   58 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
   59 
   60 This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
   61 
   62 You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA