sshブルートフォースアタックを防ぐiptablesを使ったblocksshd

% cd /usr/ports/security/blocksshd/
% sudo make install clean

/usr/local/man/man1/blocksshd.1.gz
/usr/local/bin/blocksshd
/usr/local/etc/blocksshd.conf.sample
/usr/local/etc/rc.d/blocksshd.sh

# vim: syntax=perl

$cfg = {
    os              => 'bsd',                       # Target OS - either linux or bsd
    chain           => 'blocksshd',                   # Name of iptables or pf chain
    logfile         => '/var/log/auth.log',             # Log file to monitor
    logcheck        => '10',                          # How often to check the log file
    max_attempts    => '4',                           # Max number of failures
    timeout         => '360',                         # Reset IP count if no activity after time out in seconds
    unblock         => '1',                           # Enable unblocking
    unblock_timeout => '43200',                       # Time in seconds after which to unblock a blocked IP address
    restore_blocked => '0',                           # Turn on checking for previously blocked IPs
    log_ips         => '/usr/local/etc/blocksshd.list', # Log file for blocked IPs
    pid_file        => '/var/run/blocksshd.pid',      # Location of PID file
    send_email      => '1',                           # Enable the sending of email notifications
    email           => 'root',                        # Email address to send notifications
    mail            => '/usr/bin/mail',                   # Location of mail binary
    email_whois_lookup => '1',                        # enable whois lookup of the blocked ip addres in the sent email
    whois           => '/usr/bin/whois',              # location of the whois binary
    sed             => '/bin/sed',                # location of the sed binary
    iptables        => '/sbin/iptables',              # Location of iptables binary - only for Linux
    pfctl           => '/sbin/pfctl',                 # Location of pfctl binary - only for BSD
    whitelist       => [qw{
			127.0.0.1/32
		    }],                               # whitelist - list of IPs that will never be blocked - IPs must be specified in the form address/subnet mask
};

#leave 1; here!
1;

sudo vim /etc/rc.conf

blocksshd_enable="YES"

sudo /usr/local/etc/rc.d/blocksshd.sh start

sudo /usr/local/etc/rc.d/blocksshd.sh stop

sudo kldload pf