Re: Restricting source with dDNS (dynamic DNS)

El 18/12/2009, a las 12:20, "Karl O. Pinc" <[email protected]> escribió:

> On 12/18/2009 10:16:44 AM, Peter N. M. Hansteen wrote:
>> Jim Flowers <[email protected]> writes:
>>
>>> To lock down services (particularly ssh) as tightly as possible, I
>> like to allow
>>> administrative access to a firewall only from specific ip
>> addresses.
>
>>> Unfortunately, some of the administrators are working from dynamic
>> ip addresses
>>> that change with some frequency.
>>>
>>> Is there a straightforward way to incorporate dynamic ip source
>> addresses in the
>>> pf ruleset?
>>
>> I'd say this sounds like a situation where authpf could come in quite
>> handy.
>
> How?  I thought authpf grants additional rights to those who
> can ssh.  But he wants to restrict those allowed to ssh period.
>
>

If I remember well, sometime ago somebody did a port knocking program  
and he asked in the OpenBSD misc list about to include it into the  
ports tree. He had very bad responses and a very ugly discussion. All  
the people involved into the discussion ( I wasn't ) didn't understood  
special cases like this: if you want to "close" ssh access from the  
world and let some people open ports for administration, maintenance,  
or whatever you want then authpf is not a solution but port knocking  
is. Google about that and you see your solution there. You can, for  
example, define a port combination to execute some script to send you  
a sms with the status of one specifical service and/or another to  
open, for the IP which is doing the combination (of course), the  
redirection port to the SWAT (samba web administration) in one  
specifical server so you can define different port combinations for  
different groups of users...

Google it.

Regards,

       Alvaro