/usr/local/etc/swatchrcは以下のとおり。 ------------------- watchfor /Failed password for root from/ exec /sbin/ipfw add 1 deny 20 from $11:255.255.255.255 to any exec /sbin/ipfw add 1 deny 21 from $11:255.255.255.255 to any exec /sbin/ipfw add 1 deny 22 from $11:255.255.255.255 to any exec /sbin/ipfw add 1 deny 25 from $11:255.255.255.255 to any exec /sbin/ipfw add 1 deny 110 from $11:255.255.255.255 to any mail=root,subject=Failed_password_for_root_from # watchfor /Illegal user/ exec /sbin/ipfw add 1 deny 20 from $10:255.255.255.255 to any exec /sbin/ipfw add 1 deny 21 from $10:255.255.255.255 to any exec /sbin/ipfw add 1 deny 22 from $10:255.255.255.255 to any exec /sbin/ipfw add 1 deny 25 from $10:255.255.255.255 to any exec /sbin/ipfw add 1 deny 110 from $10:255.255.255.255 to any mail=root,subject=Illegal_user ------------------- とりあえず全拒否にするのはなんなんで、 ftp(20,21),ssh(22),smtp(25),pop3(110)を拒否。 それ以外はhttpとhttps以外ポートがあいていないので。
全拒否にする場合は exec /sbin/ipfw add 1 deny all from ・・・ を各1行ずつ。
原付生活(3)
