Melhorando a segurança do seus servidores em FreeBSD

#fechando o icmp na interface externa
/sbin/ipfw add deny icmp from any to any in via bge1 icmptypes 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18

/sbin/ipfw add allow tcp from 200.xxx.xxx.98 to 200.yyy.yyy.38 22
/sbin/ipfw add allow tcp from 200.yyy.yyy.38 to 200.xxx.xxx.98 22 

/sbin/ipfw add deny all from any to any 22 in via bge1

#Aqui libero o dns e fecho todo o resto do udp nas duas interfaces
#Bloqueio de udp
/sbin/ipfw add allow udp from any to any 53
/sbin/ipfw add allow udp from any to any 53
/sbin/ipfw add deny udp from any to any in via bge0
/sbin/ipfw add deny udp from any to any out via bge0
/sbin/ipfw add deny udp from any to any in via bge1
/sbin/ipfw add deny udp from any to any out via bge1


# bloqueia pacotes fragmentados/alterados/inconformes
/sbin/ipfw add drop tcp from any to any frag
/sbin/ipfw add drop tcp from any to any tcpflags syn,rst
/sbin/ipfw add drop tcp from any to any tcpflags syn,fin
/sbin/ipfw add drop all from any to any ipoptions lsrr
/sbin/ipfw add drop all from any to any ipoptions ssrr
/sbin/ipfw add deny tcp from any to any ipoptions ssrr,lsrr,rr

#Aqui bloqueando o spoofing
# Bloqueio de pacotes com endereço origem de classes 
#de endereçamento IP reservadas
/sbin/ipfw add deny ip from 10.0.0.0:255.0.0.0 to 200.xxx.xxx.98 via bge1 in
/sbin/ipfw add deny ip from 172.16.0.0:255.0.0.0 to 200.xxx.xxx.98 via bge1 in
/sbin/ipfw add deny ip from 192.168.0.0:255.255.0.0 to 200.xxx.xxx.98 via bge1 in

#!/usr/local/bin/bash

MODE="AUTO"
#MODE="MANUAL"

if [ -f /var/log/auth.log ] ; then
   ips=$(cat /var/log/auth.log | grep -i illegal | grep -i sshd | awk -F" " {'print $15'})

   attempts=1

   for ip in $ips ; do

      lastip=$ip

      if [ "$lastip" == "$ip" ] ; then
         attempts=$(expr $attempts + 1)
         if [ $attempts -ge 3 ] ; then
            echo -n "Brute force SSHD ataque detectado vindo do ip $ip" > /dev/ttyv0
            attempts=1
            lastip=""
            blocked=$(ipfw list | grep $ip | grep deny)
                   if [ "$blocked" ] ; then
               echo -n "> Ip já bloqueado. Continuando com o scan" > /dev/ttyv0
               echo -n " " > /dev/ttyv0
            else
               if [ $MODE == "MANUAL" ] ; then
                  echo "> Você deseja bloquear este ip nas regras do IPFW? (y/n)"
                  read resp
                  if [ "$resp" == "y" ] ; then
                  /sbin/ipfw add deny ip from any to $ip
                  /sbin/ipfw add deny ip from $ip to any
                     echo "> IP $ip adicionado as regras de bloqueio"
                     echo " "
                  fi
               else
                  /sbin/ipfw add deny ip from any to $ip
                  /sbin/ipfw add deny ip from $ip to any

                  echo -n "> IP $ip adicionado as regras de bloqueio" > /dev/ttyv0
                  echo -n " " > /dev/ttyv0
                #echo $ip >> /var/log/ips
               fi
            fi
         fi
      fi

   done

fi