So far, so good. Nice to see this in the logs while I’m working on updates to mcblockd. This shows lines from my auth.log with the corresponding actions invoked in mcblockd. The key takeaway: nearly instantaneous response to login attempts from countries where I have the policy set to low tolerance, and the expected response for “US” networks where I have the tolerance set a little higher.<\/p>\n
The way this works…<\/p>\n
A mcblocklog<\/tt> process receives all auth.log entries via a pipe from syslogd. It uses a list of regular expressions (in a plain text file) to match offending lines in the log, then posts matched IP addresses to mcblockd<\/tt> as ‘logHit’ requests. Unlike my previous setup that periodically parsed entire logs, this happens in real time. mcblockd<\/tt> asks dwprdapd<\/tt> for prefix and country information, then applies configured policy. Depending on the policy for the network, mcblockd<\/tt> may instantly add an entry to its database and the pf table, or wait for the policy to be violated (number of hits over a configured time period). For foreign countries, I have the policy set to trigger from a single offending line, hence mcblockd<\/tt> will immediately add an entry to the pf table. For the U.S., I have the policy set to 5 hits in 7 days. These are experimental settings at the moment, it’s likely I’ll change them.<\/p>\n
Also part of the configured policy is how long an entry will live in the pf tables, by days. For countries which have no business connecting to my network, the policy is set long versus my own country. This is a common desired feature in an IPS (Intrusion Protection System). Another part of the policy is a ‘widest mask’ setting, to allow me to avoid blocking huge swaths of address space from a given country to whom I want to grant a bit of leniency (say the U.S. and Canada in my case). <\/p>\n
Probably worth noting that if an address is already covered in the pf tables, mcblockd<\/tt> does nothing.<\/p>\n
Also worth noting that the service is secured with libDwmAuth, using ECDH and 2048-bit RSA keys during authentication, then AES128 in GCM mode after authentication.<\/p>\n
While the log entries below are for ssh, I have a similar process for web logs and mail server logs.<\/p>\n
\r\nApr 19 05:33:30 ria sshd[7695]: error: maximum authentication attempts exceeded\r\n for root from 81.100.183.189 port 43973 ssh2 [preauth]\r\nApr 19 05:33:30 ria mcblockd[1854]: [I] Added 81.96\/12 (GB) to ssh_losers\r\n\r\nApr 19 06:09:50 ria sshd[7752]: error: maximum authentication attempts exceeded\r\n for root from 36.36.254.10 port 60635 ssh2 [preauth]\r\nApr 19 06:09:50 ria mcblockd[1854]: [I] Added 36.36\/16 (CN) to ssh_losers\r\n\r\nApr 19 09:22:37 ria sshd[8123]: error: maximum authentication attempts exceeded\r\n for root from 123.96.0.151 port 60583 ssh2 [preauth]\r\nApr 19 09:22:37 ria mcblockd[1854]: [I] Added 123.96\/15 (CN) to ssh_losers\r\n\r\nApr 19 09:29:38 ria sshd[8129]: Did not receive identification string from 34.205.143.181\r\nApr 19 09:29:43 ria sshd[8130]: Invalid user support from 34.205.143.181\r\nApr 19 09:29:43 ria sshd[8130]: Postponed keyboard-interactive for invalid user\r\n support from 34.205.143.181 port 53145 ssh2 [preauth]\r\nApr 19 09:29:43 ria sshd[8130]: error: PAM: authentication error for illegal user\r\n support from 34.205.143.181\r\nApr 19 09:29:43 ria sshd[8130]: Failed keyboard-interactive\/pam for invalid user\r\n support from 34.205.143.181 port 53145 ssh2\r\nApr 19 09:29:44 ria mcblockd[1854]: [I] Added 34.205.143\/24 (US) to ssh_losers\r\n\r\nApr 19 14:11:40 ria sshd[8666]: error: maximum authentication attempts exceeded\r\n for root from 200.73.205.204 port 45585 ssh2 [preauth]\r\nApr 19 14:11:40 ria mcblockd[1854]: [I] Added 200.73.200\/21 (EC) to ssh_losers\r\n\r\nApr 19 14:51:48 ria sshd[9272]: Invalid user admin from 77.39.72.192\r\nApr 19 14:51:48 ria mcblockd[1854]: [I] Added 77.39.0\/17 (RU) to ssh_losers\r\n\r\nApr 19 15:31:18 ria sshd[17218]: Invalid user admin from 193.105.134.184\r\nApr 19 15:31:18 ria mcblockd[1854]: [I] Added 193.105.134\/24 (SE) to ssh_losers\r\n\r\nApr 19 15:34:02 ria sshd[18020]: error: maximum authentication attempts exceeded\r\n for root from 85.90.198.244 port 44202 ssh2 [preauth]\r\nApr 19 15:34:02 ria mcblockd[31598]: [I] Added 85.90.192\/19 (UA) to ssh_losers\r\n\r\nApr 19 15:58:13 ria sshd[23696]: error: maximum authentication attempts exceeded\r\n for root from 156.213.133.233 port 58400 ssh2 [preauth]\r\nApr 19 15:58:13 ria mcblockd[31598]: [I] Added 156.192\/11 (EG) to ssh_losers\r\n\r\nApr 19 16:04:49 ria sshd[23785]: error: maximum authentication attempts exceeded\r\n for root from 171.50.175.114 port 46884 ssh2 [preauth]\r\nApr 19 16:04:49 ria mcblockd[31598]: [I] Added 171.48\/12 (IN) to ssh_losers\r\n\r\nApr 19 16:39:23 ria sshd[23858]: Invalid user support from 181.211.93.159\r\nApr 19 16:39:23 ria mcblockd[31598]: [I] Added 181.211\/16 (EC) to ssh_losers\r\n\r\nApr 19 16:59:10 ria sshd[23914]: Did not receive identification string from \r\n 128.40.46.124\r\nApr 19 16:59:10 ria mcblockd[31598]: [I] Added 128.40\/15 (GB) to ssh_losers\r\n\r\nApr 19 18:19:24 ria sshd[24599]: error: maximum authentication attempts exceeded\r\n for root from 178.216.100.130 port 52035 ssh2 [preauth]\r\nApr 19 18:19:24 ria mcblockd[31598]: [I] Added 178.216.96\/21 (UA) to ssh_losers\r\n\r\nApr 19 19:21:43 ria sshd[24873]: Invalid user admin from 200.121.233.88\r\nApr 19 19:21:43 ria mcblockd[31598]: [I] Added 200.121\/16 (PE) to ssh_losers\r\n\r\nApr 19 23:12:25 ria sshd[30989]: error: maximum authentication attempts exceeded\r\n for root from 131.161.55.11 port 42822 ssh2 [preauth]\r\nApr 19 23:12:25 ria mcblockd[31598]: [I] Added 131.161.52\/22 (HN) to ssh_losers\r\n\r\nApr 20 00:08:10 ria sshd[31282]: error: maximum authentication attempts exceeded\r\n for root from 167.250.75.214 port 4837 ssh2 [preauth]\r\nApr 20 00:08:10 ria mcblockd[31598]: [I] Added 167.250.72\/22 (BR) to ssh_losers\r\n\r\nApr 20 00:22:31 ria sshd[31674]: Did not receive identification string from\r\n 218.93.17.146\r\nApr 20 00:22:31 ria mcblockd[31598]: [I] Added 218.64\/11 (CN) to ssh_losers\r\n\r\nApr 20 00:25:41 ria sshd[31691]: Invalid user admin from 60.178.126.100\r\nApr 20 00:25:41 ria mcblockd[31598]: [I] Added 60.160\/11 (CN) to ssh_losers\r\n\r\nApr 20 00:38:12 ria sshd[31715]: Invalid user ubnt from 119.191.105.117\r\nApr 20 00:38:12 ria mcblockd[31598]: [I] Added 119.176\/12 (CN) to ssh_losers\r\n\r\nApr 20 00:45:53 ria sshd[31733]: Invalid user admin from 123.170.99.10\r\nApr 20 00:45:53 ria mcblockd[31598]: [I] Added 123.160\/12 (CN) to ssh_losers\r\n\r\nApr 20 01:39:27 ria sshd[31845]: error: maximum authentication attempts exceeded\r\n for root from 119.193.140.196 port 60716 ssh2 [preauth]\r\nApr 20 01:39:27 ria mcblockd[31598]: [I] Added 119.192\/11 (KR) to ssh_losers\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"So far, so good. Nice to see this in the logs while I’m working on updates to mcblockd. This shows lines from my auth.log with the corresponding actions invoked in mcblockd. The key takeaway: nearly instantaneous response to login attempts from countries where I have the policy set to low tolerance, and the expected response … <\/p>\n