/usr/local/etc/swatchrcは以下のとおり。 ------------------- watchfor /Failed password for root from/ exec /sbin/ipfw add 1 deny 20 from $11:255.255.255.255 to any exec /sbin/ipfw add 1 deny 21 from $11:255.255.255.255 to any exec /sbin/ipfw add 1 deny 22 from $11:255.255.255.255 to any exec /sbin/ipfw add 1 deny 25 from $11:255.255.255.255 to any exec /sbin/ipfw add 1 deny 110 from $11:255.255.255.255 to any mail=root,subject=Failed_password_for_root_from # watchfor /Illegal user/ exec /sbin/ipfw add 1 deny 20 from $10:255.255.255.255 to any exec /sbin/ipfw add 1 deny 21 from $10:255.255.255.255 to any exec /sbin/ipfw add 1 deny 22 from $10:255.255.255.255 to any exec /sbin/ipfw add 1 deny 25 from $10:255.255.255.255 to any exec /sbin/ipfw add 1 deny 110 from $10:255.255.255.255 to any mail=root,subject=Illegal_user ------------------- とりあえず全拒否にするのはなんなんで、 ftp(20,21),ssh(22),smtp(25),pop3(110)を拒否。 それ以外はhttpとhttps以外ポートがあいていないので。
全拒否にする場合は exec /sbin/ipfw add 1 deny all from ・・・ を各1行ずつ。
で、dmesg(抜粋) ppc0: <Parallel port> at port 0x378-0x37f irq 7 on isa0 ppc0: Generic chipset (EPP/NIBBLE) in COMPATIBLE mode ppbus0: IEEE1284 device found /NIBBLE Probing for PnP devices on ppbus0: ppbus0: <Canon 560i/1.05> PRINTER BJL,BJRaster3,BSCCe plip0: <PLIP network interface> on ppbus0 lpt0: <Printer> on ppbus0 lpt0: Interrupt-driven port ppi0: <Parallel I/O> on ppbus0 ってな感じ。
原付生活(3)
