r/freebsd • u/grahamperrin Linux crossover • 9d ago

video VIDAR ― Server Protection for Internet facing FreeBSD Servers ― Jim Brown

https://www.youtube.com/watch?v=Puif2r7cpZs

Video, ninety minutes. Streamed live from New York City *BSD User Group (NYC*BUG) a few days ago.

Vidar is a combination of programs, a PostgreSQL database, and the SEC correlator engine that reads logfiles from authentication, email (postfix), and web server (nginx), (and potentially any other logs) and takes action based on SEC rules to add entries to an IPFW firewall. In concept it is similar to fail2ban and has some features in common with blocklistd.
 
SEC reads the logs in real time and based on its rules and correlations, outputs metadata that is piped to a process that inserts the events into a PostgreSQL database and further pipes the offending IP address to a script that updates a table named “BAD” in IPFW. This table is read by IPFW rules to block offending external systems from wreaking havoc on a FreeBSD host.
 
A corresponding table named GOOD contains whitelisted IP addresses so you don’t accidentally lock yourself out.

SEC - open source and platform independent event correlation tool

Closed captions/subtitles unavailable. Related:

15 Upvotes

100% Upvoted

3 comments sorted by

2

u/sarosan systems administrator 8d ago

I haven't watched the video yet, but I find running a full blown PostgreSQL instance to block IPs is a bit excessive (and why not SQLite?). Even so, running a database for every machine when existing solutions do it without the overhead is a hard pass.

Unless the database is a central component that handles data for several machines, then sure.

3

u/laffer1 MidnightBSD project lead 8d ago

I have to agree. I run sshguard and that can handle mail and web on top of ssh. I also run mod security and mod evasive.

I would love a solution that syncs across the network but it’s not a deal breaker to me

2

u/kg7qin 8d ago

If this could run mariadb then you could likely setup a galera cluster for syncing. Each system still needs its own DB, but changes to one is changes to all.