Other sshd (not) using tcpwrappers ?

[peter-h]

I have a very old machine ( 8.4-RELEASE-p23 )on a remote site. It is hardened by conventional means but i still need ssh connectivity.
However scums out there loads down with fruitless ssh login attempts, some are even quite heavy.
I did dound that blocking the worst offenders in /etc/hosts.allow works fine, no restarts of anything needed.
This fit my bill

However, a news machine (12.2-RELEASE-p1 ) where sshd ignores /etc/hosts.allow.

I could rebuild sshd but before that :what is the stance of Freebsd of this ? Is the current sshd built using tcpwrappers and thus reading /etc/hosts.allow ?

 

[SirDice]

what is the stance of Freebsd of this

The stance is that you are using outdated and unsupported versions.

Thread 'Topics about unsupported FreeBSD versions'

Jun 24, 2013

The FreeBSD Forums cater primarily to end-users and systems administrators. As such, the Forums focus almost exclusively on FreeBSD versions that are officially supported according to the official FreeBSD website. Since resources are scarce, the FreeBSD Forums strongly suggest that anyone asking questions on the forums run one of the officially supported versions (see the links at the end of this post), for which the installed user base is logically the broadest.

In terms of 'unsupported versions' we make the following distinction:

1. FreeBSD versions that are...

• DutchDaemon
• Replies: 0
• Forum: Forum Rules and Guidelines (REQUIRED READING)

• 
• 

 

[serjsk8]

Hello peter-h

I don't remember exactly if there's still tcpwrappers in FreeBSD 12.2...
But maybe you could try security/sshguard, for example.

 

[covacat]

your hosts.allow is most likely problematic if the ssh daemon is the stock one. hosts.allow always worked

 

[serjsk8]

If I'm not mistaken, you can still compile OpenSSH with tcp_wrapper support.
But the tcp_wrapper is a very old solution, it's better to use a firewall now.

https://www.openssh.org/txt/release-6.7

* sshd(8): Support for tcpwrappers/libwrap has been removed.

 

[peter-h]

your hosts.allow is most likely problematic if the ssh daemon is the stock one. hosts.allow always worked

THANKS ! This made me rethink what is happening. The 12.2 machine is behind a fw ( running 12.2-RELEASE-p2 ) that is NOT forwarding ssh request but servicing them at the fw. And here is where
i need to adjust the hosts.allow, which , of course works.

Freebsd rocks, Freebsd support forum rocks.