From: John Fitzgerald (jjfitzgeraldgmail.com)
Date: Tue Oct 25 2005 - 12:32:37 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I've had ipf working on a few 5.3 servers for quite awhile. Not too long ago
some developers had to do some coding work and were coming from dynamic
IP's. I (reluctantly) opened up SSH to the world. Immediately I started
seeing the attacks where bots of some sort would try to break in with a
variety of different users.

So, I (thought) I closed it up again and told the developers to use a
dedicated proxy. They did, but I realized that I hadn't actually closed
things off. I was still getting attacked. I had tried, but ipf suddenly
wasn't working. Whenever I would change the firewall rules and ipf -D and
the ipf -E -f /etc/my.rules it would simply return:

1:ioctl(add/insert rule): No such process

I didn't have the time to look into it at the time, but am now trying to
figure it out. Ipf is obviously not working and I don't know why. I have
tried recompiling the kernel a myriad of different ways. With/without ipfw,
with/without ipsec, etc. All to no avail. Is this a bug, did I get hacked?

I have googled this quite a bit and the only thing that I found was possibly
a buildworld scenario where something got updated and it doesn't work now. I
didn't install src so I'm a bit out of luck on that one.

FreeBSD 5.3-RELEASE
OpenSSH_3.8.1p1 FreeBSD-20040419, OpenSSL 0.9.7d 17 Mar 2004

Cheers,
JJ
_______________________________________________
freebsd-securityfreebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribefreebsd.org"

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]