fosstodon.org is one of the many independent Mastodon servers you can use to participate in the fediverse.
Fosstodon is an invite only Mastodon instance that is open to those who are interested in technology; particularly free & open source software. If you wish to join, contact us for an invite.

Administered by:

Server stats:

10K
active users

#pf

3 posts3 participants1 post today
Replied in thread

@mothcompute but i think that taking this position leaves out all of the cool possibilities that you can use to trap/emulate the faults

like in your posts: making a #PF always read 0, or #GPF for a non-canonical address reads to disk/s3

I found myself with a weird connection problem at home on Monday morning. I could no longer reach my blog or any of the other services hosted either via my reverse proxy or the docker host behind it.

I thought I'd broken something on my work laptop at first but I was seeing the problem on other devices.

Long story short.... OpenBSD uses the pf firewall and has a tool to load new rules. It also has a way to test the rules before you make them live, to avoid mistakes, using 'pfctl -nf /etc/pf.conf'... well, over the weekend, guess who updated a few rules but failed to test them? Yep, this guy. So, when my backup routine ran on the VM in question overnight Sunday/Monday and restarted it, the broken ruleset prevented pf from starting, cutting everything behind it off from the world.

Every day's a school day. Some days it's college, others it's kindergarten.

What do the clever OpenBSD firewall folks use to put up a reasonable defence against known bad actors?

I have an SSH bastion host that gest spammed with connection attempts (it only accepts key authentication but even so...) as well as web server for my blog that gets requests for dot files, PHP, cpanel, etc...

On both I'm currently running a shell script that greps the logs for keywords and feeds those IP's into a temporary blocklist but I'm sure there must be a better way, plus some way to feed in a reputable source of bad IP's before they become a problem would be nice.