<commit_before># This file is managed via Puppet bgp_spamd

set skip on lo
set limit table-entries 400000
table <<%= @pftable %>> persist
table <bruteforce> persist
table <spamd-white> persist
table <nospamd> persist file "/etc/mail/nospamd"

table <siphackers> const { 172.16.58.3, 172.16.31.10, 192.168.127.12, 192.168.127.12, 172.16.58.3, 192.168.127.12 }


#block some idiots trying to brute force the asterisk
block in quick from <siphackers> to any
pass log                # to establish keep-state

# rules for spamd(8)

pass in log quick on egress proto tcp from <<%= @pftable %>> to any port smtp
pass in on egress proto tcp from any to any port smtp \
    rdr-to 127.0.0.1 port spamd
pass in log (to pflog1) on egress proto tcp from <nospamd> to self port smtp
pass in log (to pflog1) on egress proto tcp from <spamd-white> to self port smtp
pass out log (to pflog1) on egress proto tcp to any port smtp

# Adaptive rule to block SSH bruteforcers
pass in quick inet proto tcp from any to self port ssh keep state (max-src-conn 15, max-src-conn-rate 5/3, overload <bruteforce> flush global)

# By default, do not permit remote connections to X11
block in on ! lo0 proto tcp to port 6000:6010<commit_msg>Add block from bruteforce table, as well as adapting the adaptive rule a bit<commit_after># This file is managed via Puppet bgp_spamd

set skip on lo
set limit table-entries 400000
table <<%= @pftable %>> persist
table <bruteforce> persist
table <spamd-white> persist
table <nospamd> persist file "/etc/mail/nospamd"

table <siphackers> const { 172.16.58.3, 172.16.31.10, 192.168.127.12, 192.168.127.12, 172.16.58.3, 192.168.127.12 }

block quick from <bruteforce>

#block some idiots trying to brute force the asterisk
block in quick from <siphackers> to any
pass log                # to establish keep-state

# rules for spamd(8)

pass in log quick on egress proto tcp from <<%= @pftable %>> to any port smtp
pass in on egress proto tcp from any to any port smtp \
    rdr-to 127.0.0.1 port spamd
pass in log (to pflog1) on egress proto tcp from <nospamd> to self port smtp
pass in log (to pflog1) on egress proto tcp from <spamd-white> to self port smtp
pass out log (to pflog1) on egress proto tcp to any port smtp

# Adaptive rule to block SSH bruteforcers
pass in quick inet proto tcp from any to self port ssh keep state (max-src-conn 5, max-src-conn-rate 3/30, overload <bruteforce> flush global)

# By default, do not permit remote connections to X11
block in on ! lo0 proto tcp to port 6000:6010
{'fraction_non_alphanumeric': 0.08144616607071911, 'fraction_numerical': 0.07071911005164878, 'mean_word_length': 3.750943396226415, 'pattern_counts': {'":': 0, '<': 28, '<?xml version=': 0, '>': 28, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 14, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7448588', 'n_tokens_mistral': 996, 'n_tokens_neox': 847, 'n_words': 380}