напрасно .. knockd элементарно настраивается и из под Win соединиться вообще не проблема ..skorin писал(а):т.к. приходиться часто соеденяться с сервером из разных мест и чаще всего через Windows.
WinKnock.rar knock-cygwin.zip
Код: Выделить всё
Sep 21 19:17:41 gw-ular sshd[1667]: Invalid user khsdfjk from 192.168.1.8
Sep 21 19:17:41 gw-ular sshit: sshit started. using ipfw2
Sep 21 19:17:41 gw-ular syslogd: Logging subprocess 1669 (exec /usr/local/sbin/sshit) exited due to signal 12.
Sep 21 19:17:41 gw-ular kernel: pid 1669 (perl), uid 0: exited on signal 12
Sep 21 19:17:41 gw-ular kernel: Sep 21 19:17:41 gw-ular kernel: pid 1669 (perl), uid 0: exited on signal 12
Sep 21 19:17:42 gw-ular sshd[1667]: error: PAM: authentication error for illegal user khsdfjk from 192.168.1.8
Sep 21 19:17:42 gw-ular kernel: Sep 21 19:17:42 gw-ular sshd[1667]: error: PAM: authentication error for illegal user khsdfjk from 192.168.1.8
Sep 21 19:17:42 gw-ular sshd[1667]: Failed keyboard-interactive/pam for invalid user khsdfjk from 192.168.1.8 port 64243 ssh2
Sep 21 19:17:42 gw-ular sshit: sshit started. using ipfw2
Sep 21 19:17:42 gw-ular syslogd: Logging subprocess 1672 (exec /usr/local/sbin/sshit) exited due to signal 12.
Sep 21 19:17:42 gw-ular kernel: pid 1672 (perl), uid 0: exited on signal 12
Sep 21 19:17:42 gw-ular kernel: Sep 21 19:17:42 gw-ular kernel: pid 1672 (perl), uid 0: exited on signal 12
Sep 21 19:17:43 gw-ular sshd[1667]: error: PAM: authentication error for illegal user khsdfjk from 192.168.1.8
Sep 21 19:17:43 gw-ular kernel: Sep 21 19:17:43 gw-ular sshd[1667]: error: PAM: authentication error for illegal user khsdfjk from 192.168.1.8
Sep 21 19:17:43 gw-ular sshd[1667]: Failed keyboard-interactive/pam for invalid user khsdfjk from 192.168.1.8 port 64243 ssh2
Код: Выделить всё
FreeBSD gw-ular.ular.lviv.ua 8.1-RELEASE FreeBSD 8.1-RELEASE #0: Tue Sep 21 13:12:56 EEST 2010 admin@gw-ular.ular.lviv.ua:/usr/obj/usr/src/sys/gw-ular i386
Код: Выделить всё
MAX_COUNT = 3
WITHIN_TIME = 60Код: Выделить всё
[b]Dec 22 23:06:08 bsdsys sshd[4915]: Invalid user ____ from 212.54.150.27
Dec 23 04:07:34 bsdsys sshd[7359]: Invalid user admin from 209.200.252.108
Dec 23 04:07:37 bsdsys sshd[7362]: Invalid user admin from 209.200.252.108
Dec 23 04:07:37 bsdsys bruteblock[7361]: Adding 209.200.252.108 to the ipfw table 1[/b]
Код: Выделить всё
Dec 23 23:40:28 bsdsys sshd[17358]: Invalid user oracle from 31.210.120.6
Dec 23 23:40:30 bsdsys sshd[17360]: Invalid user test from 31.210.120.6
[b][u]Dec 23 23:40:30 bsdsys bruteblock[13560]: Adding 31.210.120.6 to the ipfw table 1[/u][/b]
Dec 23 23:40:41 bsdsys sshd[17393]: Invalid user teamspeak from 31.210.120.6
Dec 23 23:40:41 bsdsys bruteblock[13560]: Blocking failed for 31.210.120.6
Dec 23 23:40:43 bsdsys sshd[17395]: Invalid user teamspeak from 31.210.120.6
Dec 23 23:40:43 bsdsys bruteblock[13560]: Blocking failed for 31.210.120.6
Dec 23 23:40:44 bsdsys sshd[17397]: Invalid user nagios from 31.210.120.6
Dec 23 23:40:44 bsdsys bruteblock[13560]: Blocking failed for 31.210.120.6
[b][u]Dec 23 23:40:46 bsdsys sshd[17399]: Invalid user postgres from 31.210.120.6
Dec 23 23:40:46 bsdsys bruteblock[13560]: Blocking failed for 31.210.120.6[/u][/b]
Код: Выделить всё
root@:/var/log # cat /etc/pf.conf
ext_if = "tun0"
int_if = "rl0"
tcp_services = "{ 22 }"
nat on $ext_if from $int_if:network to any -> ($ext_if)
block all
table <badhosts> persist
block on $ext_if from <badhosts> to any
pass quick proto igmp to any allow-opts
pass in on $int_if proto udp to 239.0.0.0/8
pass in on $int_if from any to any
pass out on $ext_if from $ext_if to any
pass in on $ext_if proto tcp from any to $ext_if port $tcp_services
pass in inet proto icmp all icmp-type echoreq
root@:/var/log # cat /usr/local/etc/sshit.conf | grep pf
# We use pf as firewall on default
FIREWALL_TYPE = pf
IPFW_CMD = /sbin/ipfw
IPFW2_CMD = /sbin/ipfw
PFCTL_CMD = /sbin/pfctl
логи:root@:/var/log # cat /etc/rc.conf | grep pf
pf_enable="YES"
pflog_enable="YES"
pf_rules="/etc/pf.conf"
pf_program="/sbin/pfctl"
pf_flags=""
вроде добавил все как по мануалу...Feb 12 01:13:29 sshd[1777]: Invalid user haqr from 114.66.192.86
Feb 12 01:13:29 sshit: block for 114.66.192.86 not working!
Feb 12 01:13:32 sshd[1779]: Invalid user haqr from 114.66.192.86
Feb 12 01:13:32 sshit: block for 114.66.192.86 not working!
Feb 12 01:13:35 sshd[1781]: Invalid user viswanathb from 114.66.192.86
Feb 12 01:13:35 sshit: block for 114.66.192.86 not working!
Feb 12 01:13:41 sshd[1785]: Invalid user mohammeda from 114.66.192.86
Feb 12 01:13:41 sshit: block for 114.66.192.86 not working!
Feb 12 01:13:44 sshd[1787]: Invalid user josej from 114.66.192.86
Feb 12 01:13:44 sshit: block for 114.66.192.86 not working!
Feb 12 03:15:49 sshd[1257]: Received signal 15; terminating.
Feb 12 21:08:49 sshd[1252]: Server listening on :: port 22.
Feb 12 21:08:49 sshd[1252]: Server listening on 0.0.0.0 port 22.
Feb 12 21:18:32 sshd[1324]: Accepted publickey for radist from 10.10.220.5 port 1054 ssh2
честно честно..