Note jpb will be remote, but there will be people watching at the Brass Monkey ** VIDAR - Server Protection for Internet facing FreeBSD Servers, Jim Brown 2026-08-05 @ 18:45 local (22:45 UTC) - Backroom of Brass Monkey 55 Little West 12th St Vidar is a combination of programs, a PostgreSQL database, and the SEC correlator engine that reads logfiles from authentication, email (postfix), and web server (nginx), (and potentially any other logs) and takes action based on SEC rules to add e ntries to an IPFW firewall. In concept it is similar to fail2ban and has some features in common with blocklistd. SEC reads the logs in real time and based on its rules and correlations, outputs metadata that is piped to a process that inserts the events into a PostgreSQL database and further pipes the offending IP address to a script that updates a table named “BAD” in IPFW. This table is read by IPFW rules to block offending external systems from wreaking havoc on a FreeBSD host. A corresponding table named GOOD contains whitelisted IP addresses so you don’t accidentally lock yourself out. <RANT> Are you sick and tired of seeing: 2a03:b0c0:3:d0::402:d001 - - [31/Jan/2026:17:37:17 -0500] \x16\x03\x01\x05\xDE\x01 ... in your nginx logs and sick of seeing: Feb 20 16:36:03 jimby dovecot[59472]: imap-login: Disconnected: Connection closed (no auth attempts in 5 secs): user=<>, rip=206.168.34.125, lip=174.136.97.66, TLS: Connection closed, ... in your mail logs and sick of seeing: Feb 20 12:47:58 jimby sshd-session[47730]: Invalid user zzzz from 2607:f170:44:12::5d0 port 520 in your authentication logs? With Vidar, you get to put the hammer down: “If you abuse my system, I will shut you out. Permanently.” </RANT> Vidar has additional tricks - a way to dump the IPFW BAD table and a way to import it later - you can keep this database of shame up to date on all those miscreants and keep them away. You can even import the BAD table on another FreeBSD system running IPFW. Also, there’s a handy audit script that lets you compare the entries in the database with what is actually in the IPFW BAD table. Also, Vidar keeps the evidence of the event in question that resulted in blocked access. Finally, using SEC rules, you can make the block last for an hour (for a misconfigured remote system) or a day (for a script kiddie), or permanently (for a determined hacker), or any length of time you choose. There is also a feature to check live processes and alert if, for example, the vi editor is running at 2:00am in the morning. Jim Brown is a long time BSD aficionado who currently lives in Durham, NC. Nearest NYC Subway is the 14th Street/Eighth Avenue station L, A, C, E. To get to the backroom, you must enter the front door, follow the long bar on your left, and walk all the way to the back. At the rear of the BrassMonkey, you will see an alcove for the 3 bathrooms our room is off to your right. _______________________________________________ announce mailing list announce@lists.nycbug.org https://lists.nycbug.org:8443/mailman/listinfo/announce
No comments:
Post a Comment