mirror of
https://git.freebsd.org/src.git
synced 2026-01-16 23:02:24 +00:00
48e64ca13d
Merge commit '70f30afd4e9af5a51ee324d97e4d8c5f2124ec15'
Breaking changes:
- Upstream commit 24932b6 ("blocklistd: log the conf file line number
with bad protocol errors") breaks backward database compatibility.
An error will be displayed:
Key size mismatch 296 != 288
A new and compatible database, with the new name, will be created when the
service starts (committed separately).
- Upstream commit ddf6d71 ("implement BLOCKLIST_BAD_USER as a
"one-count" failure") introduced BLOCKLIST_BAD_USER with a one-count
failure mechanism. BLOCKLIST_AUTH_FAIL was implemented with a
two-count failure mechanism. Since we utilize BLOCKLIST_AUTH_FAIL, the
number of failed attempts now doubles towards the maximum limit
(nfails). This commit will be reverted separately.
Changes:
7093cd9...8aa81bf
Approved by: emaste (mentor)
MFC after: 2 days
Differential Revision: https://reviews.freebsd.org/D52869
113 lines
4.3 KiB
Text
113 lines
4.3 KiB
Text
# $NetBSD: README,v 1.3 2024/02/09 00:53:30 wiz Exp $
|
|
|
|
This package contains library that can be used by network daemons to
|
|
communicate with a packet filter via a daemon to enforce opening and
|
|
closing ports dynamically based on policy.
|
|
|
|
The interface to the packet filter is in libexec/blocklistd-helper
|
|
(this is currently designed for npf) and the configuration file
|
|
(inspired from inetd.conf) is in etc/blocklistd.conf.
|
|
|
|
On NetBSD you can find an example npf.conf and blocklistd.conf in
|
|
/usr/share/examples/blocklistd; you need to adjust the interface
|
|
in npf.conf and copy both files to /etc; then you just enable
|
|
blocklistd=YES in /etc/rc.conf, start it up, and you are all set.
|
|
|
|
There is also a startup file in etc/rc.d/blocklistd
|
|
|
|
Patches to various daemons to add blocklisting capabilities are in the
|
|
"diff" directory:
|
|
- OpenSSH: diff/ssh.diff [tcp socket example]
|
|
- Bind: diff/named.diff [both tcp and udp]
|
|
- ftpd: diff/ftpd.diff [tcp]
|
|
|
|
These patches have been applied to NetBSD-current.
|
|
|
|
The network daemon (for example sshd) communicates to blocklistd, via
|
|
a Unix socket like syslog. The library calls are simple and everything
|
|
is handled by the library. In the simplest form the only thing the
|
|
daemon needs to do is to call:
|
|
|
|
blocklist(action, acceptedfd, message);
|
|
|
|
Where:
|
|
action = 0 -> successful login clear blocklist state
|
|
1 -> failed login, add to the failed count
|
|
acceptedfd -> the file descriptor where the server is
|
|
connected to the remote client. It is used
|
|
to determine the listening socket, and the
|
|
remote address. This allows any program to
|
|
contact the blocklist daemon, since the verification
|
|
if the program has access to the listening
|
|
socket is done by virtue that the port
|
|
number is retrieved from the kernel.
|
|
message -> an optional string that is used in debugging logs.
|
|
|
|
Unfortunately there is no way to get information about the "peer"
|
|
from a udp socket, because there is no connection and that information
|
|
is kept with the server. In that case the daemon can provide the
|
|
peer information to blocklistd via:
|
|
|
|
blocklist_sa(action, acceptedfd, sockaddr, sockaddr_len, message);
|
|
|
|
The configuration file contains entries of the form:
|
|
|
|
# Blocklist rule
|
|
# host/Port type protocol owner name nfail disable
|
|
192.168.1.1:ssh stream tcp * -int 10 1m
|
|
8.8.8.8:ssh stream tcp * -ext 6 60m
|
|
ssh stream tcp6 * * 6 60m
|
|
http stream tcp * * 6 60m
|
|
|
|
Here note that owner is * because the connection is done from the
|
|
child ssh socket which runs with user privs. We treat IPv4 connections
|
|
differently by maintaining two different rules one for the external
|
|
interface and one from the internal We also register for both tcp
|
|
and tcp6 since those are different listening sockets and addresses;
|
|
we don't bother with IPv6 and separate rules. We use nfail = 6,
|
|
because ssh allows 3 password attempts per connection, and this
|
|
will let us have 2 connections before blocking. Finally we block
|
|
for an hour; we could block forever too by specifying * in the
|
|
duration column.
|
|
|
|
blocklistd and the library use syslog(3) to report errors. The
|
|
blocklist filter state is persisted automatically in /var/db/blocklistd.db
|
|
so that if the daemon is restarted, it remembers what connections
|
|
is currently handling. To start from a fresh state (if you restart
|
|
npf too for example), you can use -f. To watch the daemon at work,
|
|
you can use -d.
|
|
|
|
The current control file is designed for npf, and it uses the
|
|
dynamic rule feature. You need to create a dynamic rule in your
|
|
/etc/npf.conf on the group referring to the interface you want to block
|
|
called blocklistd as follows:
|
|
|
|
ext_if=bge0
|
|
int_if=sk0
|
|
|
|
group "external" on $ext_if {
|
|
...
|
|
ruleset "blocklistd-ext"
|
|
ruleset "blocklistd"
|
|
...
|
|
}
|
|
|
|
group "internal" on $int_if {
|
|
...
|
|
ruleset "blocklistd-int"
|
|
...
|
|
}
|
|
|
|
You can use 'blocklistctl dump -a' to list all the current entries
|
|
in the database; the ones that have nfail <c>/<t> where <c>urrent
|
|
>= <t>otal, should have an id associated with them; this means that
|
|
there is a packet filter rule added for that entry. For npf, you
|
|
can examine the packet filter dynamic rule entries using 'npfctl
|
|
rule <rulename> list'. The number of current entries can exceed
|
|
the total. This happens because entering packet filter rules is
|
|
asynchronous; there could be other connection before the rule
|
|
becomes activated.
|
|
|
|
Enjoy,
|
|
|
|
christos
|