APF and BFD on Debian
March 8, 2008
Howto install APF / BFD on a Debian system
..
cd /opt
1. wget http://www.r-fx.ca/downloads/apf-current.tar.gz
2. wget http://www.mnxsolutions.com/scripts/apf.debian.init
3. tar -xzvf apf-current.tar.gz
4. cd apf-0.9.6-1/
5. ./install.sh
You will recieve back messages like below.. Notice the cp error.
Installing APF 0.9.6-1: cp: cannot create regular file `/etc/rc.d/init.d/apf’: No such file or directory
Completed.
Installation Details:
Install path: /etc/apf/
Config path: /etc/apf/conf.apf
Executable path: /usr/local/sbin/apf
AntiDos install path: /etc/apf/ad/
AntiDos config path: /etc/apf/ad/conf.antidos
DShield Client Parser: /etc/apf/extras/dshield/
Other Details:
Listening TCP ports: 21,25,53,465,587
Listening UDP ports: 53,1812,1813,48921
Note: These ports are not auto-configured; they are simply presented for information purposes. You must manually configure all port options.
6. mv /opt/apf.debian.init /etc/init.d/apf
7. chmod +x /etc/init.d/apf
8. update-rc.d apf defaults
9. Edit /etc/apf/conf.apf to appropriate settings you may include Listening TCP/UDP from above if approp.
10. /etc/init.d/apf start
11. Validate, change /etc/apf/conf.apf DEVEL_MODE=”0″
12. restart apf; /etc/init.d/apf restart
— Configure / Install BFD
.. cd /opt
1. wget http://www.r-fx.ca/downloads/bfd-current.tar.gz
2. tar -xzvf bfd-current.tar.gz
3. cd bfd-0.9/
4. ./install.sh
5. vi /usr/local/bfd/conf.bfd
Modify SLOG=”/var/log/secure” to SLOG=”/var/log/auth.log”
6. cd /usr/local/bfd/rules
7. mv sshd /tmp/bfd.old.rules.sshd # Just in case
8. wget http://www.mnxsolutions.com/scripts/bfd.rules.sshd -O sshd ; this works out of the box (or it did) for debian sarge.
9. chmod 600 sshd
For ubuntu my sshd rule ended up like:
REQ=”/usr/sbin/sshd”
if [ -f "$REQ" ]; then
LP=”/var/log/auth.log”
TLOG_TF=”sshd”
TRIG=”3″
TMP=”/usr/local/bfd/tmp”
## SSH
ARG_VAL1=`$TLOGP $LP $TLOG_TF.1 | grep sshd | grep -viw “error: BIND” | sed ’s/::ffff://’ | grep -iw “Failed password for invalid user” | awk ‘{print$13″:”$11}’ | grep -E ‘[0-9]+’ > $TMP/.sshd`
ARG_VAL=`cat $TMP/.sshd`
fi
10. edit /etc/ssh/sshd_config and add the following:
UseDNS no
11. /etc/init.d/ssh restart
Comments
Got something to say?
