{"id":2193,"date":"2025-12-09T11:30:01","date_gmt":"2025-12-09T02:30:01","guid":{"rendered":"https:\/\/bokumin.org\/blog\/?p=2193"},"modified":"2025-12-09T11:37:20","modified_gmt":"2025-12-09T02:37:20","slug":"ssh%e3%83%96%e3%83%ab%e3%83%bc%e3%83%88%e3%83%95%e3%82%a9%e3%83%bc%e3%82%b9%e5%af%be%e7%ad%96%e3%81%afpf%e3%81%a0%e3%81%91%e3%81%a7%e5%ae%8c%e7%b5%90%e3%81%95%e3%81%9b%e3%82%8b","status":"publish","type":"post","link":"https:\/\/www.bokumin.org\/blog\/2025\/12\/09\/ssh%e3%83%96%e3%83%ab%e3%83%bc%e3%83%88%e3%83%95%e3%82%a9%e3%83%bc%e3%82%b9%e5%af%be%e7%ad%96%e3%81%afpf%e3%81%a0%e3%81%91%e3%81%a7%e5%ae%8c%e7%b5%90%e3%81%95%e3%81%9b%e3%82%8b\/","title":{"rendered":"SSH\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u5bfe\u7b56\u3092pf\u3060\u3051\u3067\u5b8c\u7d50\u3055\u305b\u308b"},"content":{"rendered":"\n<p>pf Alone is Enough for SSH Defense<\/p>\n\n\n\n<p>\u9577\u3089\u304fFail2ban\u3092\u4f7f\u3063\u3066SSH\u306e\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u5bfe\u7b56\u3092\u3057\u3066\u304d\u3066\u3044\u307e\u3057\u305f\u304c\u3001FreeBSD\u306eFW\u30b5\u30fc\u30d0\u30fc\u3067\u306f\u5b9f\u306f\u4e0d\u8981\u3060\u3063\u305f\u3053\u3068\u306b\u6c17\u3065\u304d\u307e\u3057\u305f\u3002\/etc\/pf.conf\u306b\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u8a18\u8ff0\u3057\u307e\u3059\u3002<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro cbp-has-line-numbers\" data-code-block-pro-font-family=\"\" style=\"font-size:.875rem;--cbp-line-number-color:#babed8;--cbp-line-number-width:calc(1 * 0.6 * .875rem);line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span role=\"button\" tabindex=\"0\" style=\"color:#babed8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly># ext_if\u306f\u5916\u5411\u304d\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\n# firewall_host\u306f\u81ea\u5206\u81ea\u8eab\npass in on $ext_if inet proto tcp to $firewall_host port 22 flags S\/SA keep state \\\n  (max-src-conn 5, max-src-conn-rate 5\/30, \\\n  overload &lt;ratelimit> flush global)<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki material-theme-ocean\" style=\"background-color: #0F111A\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #464B5D; font-style: italic\"># ext_if\u306f\u5916\u5411\u304d\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af<\/span><\/span>\n<span class=\"line\"><span style=\"color: #464B5D; font-style: italic\"># firewall_host\u306f\u81ea\u5206\u81ea\u8eab<\/span><\/span>\n<span class=\"line\"><span style=\"color: #FFCB6B\">pass<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">in<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">on<\/span><span style=\"color: #BABED8\"> $ext_if <\/span><span style=\"color: #C3E88D\">inet<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">proto<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">tcp<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">to<\/span><span style=\"color: #BABED8\"> $firewall_host <\/span><span style=\"color: #C3E88D\">port<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #F78C6C\">22<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">flags<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">S\/SA<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">keep<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">state<\/span><span style=\"color: #BABED8\"> \\<\/span><\/span>\n<span class=\"line\"><span style=\"color: #BABED8\">  (max-src-conn <\/span><span style=\"color: #F78C6C\">5<\/span><span style=\"color: #C3E88D\">,<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">max-src-conn-rate<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #F78C6C\">5<\/span><span style=\"color: #C3E88D\">\/30,<\/span><span style=\"color: #BABED8\"> \\<\/span><\/span>\n<span class=\"line\"><span style=\"color: #BABED8\">  <\/span><span style=\"color: #C3E88D\">overload<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #89DDFF\">&lt;<\/span><span style=\"color: #C3E88D\">ratelimi<\/span><span style=\"color: #BABED8\">t<\/span><span style=\"color: #89DDFF\">&gt;<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">flush<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">global<\/span><span style=\"color: #BABED8\">)<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p><strong>max-src-conn 5<\/strong>\u2192\u540c\u3058IP\u304b\u3089\u540c\u6642\u306b5\u500b\u307e\u3067\u63a5\u7d9a\u53ef\u80fd<br><strong>max-src-conn-rate 5\/30<\/strong>\u219230\u79d2\u9593\u306b5\u56de\u307e\u3067\u65b0\u898f\u63a5\u7d9a\u53ef\u80fd<\/p>\n\n\n\n<p>\u3053\u306e\u8a2d\u5b9a\u306b\u3088\u308a\u3001<strong>30\u79d2\u4ee5\u5185\u306b5\u56de\u4ee5\u4e0a\u306e\u63a5\u7d9a\u8a66\u884c\u3092\u81ea\u52d5\u30d6\u30ed\u30c3\u30af<\/strong>\u3057\u3001<strong>\u540c\u6642\u63a5\u7d9a\u6570\u30925\u500b\u306b\u5236\u9650<\/strong>\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n\n\n\n<p>Fail2ban\u306f\u5e38\u99d0\u30d7\u30ed\u30bb\u30b9\u3067\u3001\u30ea\u30bd\u30fc\u30b9\u3092\u7d50\u69cb\u98df\u3063\u3066\u3044\u305f\u306e\u3067\u4e0d\u8981\u306a\u3089\u524a\u9664\u3059\u3079\u304d\u3060\u3068\u5224\u65ad\u3057\u307e\u3057\u305f\u3002<\/p>\n\n\n\n<p class=\"has-large-font-size\"><strong>\u307e\u3068\u3081<\/strong><\/p>\n\n\n\n<p>Fail2ban\u304c\u5fc5\u8981\u306b\u306a\u308b\u306e\u306f\u3001\u30ed\u30b0\u5185\u5bb9\u306b\u57fa\u3065\u304f\u5224\u65ad\uff08\u30d1\u30b9\u30ef\u30fc\u30c9\u5931\u6557\u56de\u6570\u3001\u4e0d\u6b63\u30e6\u30fc\u30b6\u30fc\u540d\u306a\u3069\uff09\u3001\u8907\u6570\u30b5\u30fc\u30d3\u30b9\u306e\u7d71\u5408\u7ba1\u7406\uff08SSH\/HTTP\/\u30e1\u30fc\u30eb\u306a\u3069\uff09\u3001mod_security\u3068\u306e\u9023\u643a\u306a\u3069\u3001\u9ad8\u5ea6\u306a\u30a2\u30af\u30bb\u30b9\u5236\u5fa1\u304c\u5fc5\u8981\u306a\u5834\u5408\u3067\u3059\u3002\u5b9f\u969b\u3001\u79c1\u306eWeb\u30b5\u30fc\u30d0\u3067\u306fmod_security\u3068\u7d44\u307f\u5408\u308f\u305b\u3066Fail2ban\u3092\u4f7f\u7528\u3057\u3066\u3044\u307e\u3059\u304c\u3001\u3053\u308c\u306fpf\u3060\u3051\u3067\u306f\u5b9f\u73fe\u3067\u304d\u306a\u3044\u9632\u5fa1\u3067\u3059\u3002<br>\u4e00\u65b9\u3067\u3001\u5358\u7d14\u306aFW\u30b5\u30fc\u30d0\u306eSSH\u30a2\u30af\u30bb\u30b9\u5236\u5fa1\u306a\u3089\u3001pf\u306e\u30ec\u30fc\u30c8\u5236\u9650\u3068\u5730\u7406\u7684\u30d6\u30ed\u30c3\u30af\u3050\u3089\u3044\u3067\u5341\u5206\u3067\u3059\u3002<\/p>\n\n\n\n<p>\u5730\u7406\u7684\u30d6\u30ed\u30c3\u30af\u306b\u95a2\u3057\u3066\u306f\u4ee5\u4e0b\u306e\u8a18\u4e8b\u3092\u53c2\u8003\u306b\u3057\u3066\u3082\u3089\u3048\u308b\u3068\u5e78\u3044\u3067\u3059\u3002<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-wp-embed is-provider-blog-bokumin-org wp-block-embed-blog-bokumin-org\"><div class=\"wp-block-embed__wrapper\">\n<div class=\"wp-embed-custom-wrapper my-6 bg-white rounded-lg shadow-sm border border-gray-200 overflow-hidden hover:shadow-md transition-shadow duration-300\"><blockquote class=\"wp-embedded-content\" data-secret=\"KWov9Av9b5\"><a href=\"https:\/\/bokumin.org\/blog\/2025\/08\/29\/freebsdpf%e3%81%a7%e6%97%a5%e6%9c%ac%e4%bb%a5%e5%a4%96%e3%81%8b%e3%82%89%e3%81%aessh%e6%8e%a5%e7%b6%9a%e3%82%92%e3%83%96%e3%83%ad%e3%83%83%e3%82%af%e3%81%99%e3%82%8b\/\">FreeBSD+PF\u3067\u65e5\u672c\u4ee5\u5916\u304b\u3089\u306eSSH\u63a5\u7d9a\u3092\u30d6\u30ed\u30c3\u30af\u3059\u308b<\/a><\/blockquote><iframe loading=\"lazy\" class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; visibility: hidden;\" title=\"&#8220;FreeBSD+PF\u3067\u65e5\u672c\u4ee5\u5916\u304b\u3089\u306eSSH\u63a5\u7d9a\u3092\u30d6\u30ed\u30c3\u30af\u3059\u308b&#8221; &#8212; Blog | bokumin.org\" src=\"https:\/\/bokumin.org\/blog\/2025\/08\/29\/freebsdpf%e3%81%a7%e6%97%a5%e6%9c%ac%e4%bb%a5%e5%a4%96%e3%81%8b%e3%82%89%e3%81%aessh%e6%8e%a5%e7%b6%9a%e3%82%92%e3%83%96%e3%83%ad%e3%83%83%e3%82%af%e3%81%99%e3%82%8b\/embed\/#?secret=u5NpZ4yuiM#?secret=KWov9Av9b5\" data-secret=\"KWov9Av9b5\" width=\"500\" height=\"282\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe><\/div>\n<\/div><\/figure>\n\n\n\n<p><br>\u30b7\u30b9\u30c6\u30e0\u306f\u30b7\u30f3\u30d7\u30eb\u306b\u4fdd\u3064\u3079\u304d\u3067\u3059\u3002\u4e0d\u8981\u306aFail2ban\u3092\u524a\u9664\u3059\u308b\u3053\u3068\u3067\u3001\u3088\u308a\u7ba1\u7406\u3057\u3084\u3059\u304f\u306a\u308a\u307e\u3057\u305f\u3002<\/p>\n\n\n\n<p><strong>\u88dc\u8db3\u3068\u3057\u3066<\/strong>\u3001\u5b9a\u671f\u7684\u306bratelimit\u30c6\u30fc\u30d6\u30eb\u3092\u30af\u30ea\u30a2\u3057\u305f\u3044\u5834\u5408\u306f\u3001cron\u3067\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u8a2d\u5b9a\u3057\u307e\u3059\uff081\u65e5\u4ee5\u4e0a\u524d\u306b\u30d6\u30ed\u30c3\u30af\u3055\u308c\u305fIP\u3092\u89e3\u9664\uff09\u3002<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro cbp-has-line-numbers\" data-code-block-pro-font-family=\"\" style=\"font-size:.875rem;--cbp-line-number-color:#babed8;--cbp-line-number-width:calc(1 * 0.6 * .875rem);line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span role=\"button\" tabindex=\"0\" style=\"color:#babed8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>0 * * * * \/sbin\/pfctl -t ratelimit -T expire 86400<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki material-theme-ocean\" style=\"background-color: #0F111A\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #FFCB6B\">0<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #BABED8\">*<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #BABED8\">*<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #BABED8\">*<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #BABED8\">*<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">\/sbin\/pfctl<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">-t<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">ratelimit<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">-T<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #C3E88D\">expire<\/span><span style=\"color: #BABED8\"> <\/span><span style=\"color: #F78C6C\">86400<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p><\/p>\n\n\n\n<p>\u304a\u308f\u308a<\/p>\n","protected":false},"excerpt":{"rendered":"<p>pf Alone is Enough for SSH Defense \u9577\u3089\u304fFail2ban\u3092\u4f7f\u3063\u3066SSH\u306e\u30d6\u30eb\u30fc\u30c8\u30d5\u30a9\u30fc\u30b9\u5bfe\u7b56\u3092\u3057\u3066\u304d\u3066\u3044\u307e\u3057\u305f\u304c\u3001FreeBSD\u306eFW\u30b5\u30fc\u30d0\u30fc\u3067\u306f\u5b9f\u306f\u4e0d\u8981\u3060\u3063\u305f\u3053\u3068\u306b\u6c17\u3065\u304d\u307e\u3057\u305f\u3002\/e [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"cybocfi_hide_featured_image":"","footnotes":""},"categories":[110,108,109],"tags":[181,121],"class_list":["post-2193","post","type-post","status-publish","format-standard","hentry","category-firewall","category-freebsd","category-pf","tag-bruteforce","tag-fail2ban"],"_links":{"self":[{"href":"https:\/\/www.bokumin.org\/blog\/wp-json\/wp\/v2\/posts\/2193","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.bokumin.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.bokumin.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.bokumin.org\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bokumin.org\/blog\/wp-json\/wp\/v2\/comments?post=2193"}],"version-history":[{"count":5,"href":"https:\/\/www.bokumin.org\/blog\/wp-json\/wp\/v2\/posts\/2193\/revisions"}],"predecessor-version":[{"id":2199,"href":"https:\/\/www.bokumin.org\/blog\/wp-json\/wp\/v2\/posts\/2193\/revisions\/2199"}],"wp:attachment":[{"href":"https:\/\/www.bokumin.org\/blog\/wp-json\/wp\/v2\/media?parent=2193"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.bokumin.org\/blog\/wp-json\/wp\/v2\/categories?post=2193"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.bokumin.org\/blog\/wp-json\/wp\/v2\/tags?post=2193"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}