Tonight NYC*BUG: jpb on VIDAR

[George Rosamond]

Note jpb will be remote, but there will be people watching at the Brass
Monkey

**

 VIDAR - Server Protection for Internet facing FreeBSD Servers, Jim Brown
2026-08-05 @ 18:45 local (22:45 UTC) - Backroom of Brass Monkey 55
Little West 12th St

Vidar is a combination of programs, a PostgreSQL database, and the SEC
correlator engine that reads logfiles from authentication, email
(postfix), and web server (nginx), (and potentially any other logs) and
takes action based on SEC rules to add e ntries to an IPFW firewall. In
concept it is similar to fail2ban and has some features in common with
blocklistd.

SEC reads the logs in real time and based on its rules and correlations,
outputs metadata that is piped to a process that inserts the events into
a PostgreSQL database and further pipes the offending IP address to a
script that updates a table named “BAD” in IPFW. This table is read by
IPFW rules to block offending external systems from wreaking havoc on a
FreeBSD host.

A corresponding table named GOOD contains whitelisted IP addresses so
you don’t accidentally lock yourself out.

<RANT>

Are you sick and tired of seeing:

2a03:b0c0:3:d0::402:d001 - - [31/Jan/2026:17:37:17 -0500]
\x16\x03\x01\x05\xDE\x01 ...

in your nginx logs and sick of seeing:

Feb 20 16:36:03 jimby dovecot[59472]: imap-login: Disconnected:
Connection closed (no auth attempts in 5 secs): user=<>,
rip=206.168.34.125, lip=174.136.97.66, TLS: Connection closed, ...

in your mail logs and sick of seeing:

Feb 20 12:47:58 jimby sshd-session[47730]: Invalid user zzzz from
2607:f170:44:12::5d0 port 520

in your authentication logs?

With Vidar, you get to put the hammer down:

“If you abuse my system, I will shut you out. Permanently.”

</RANT>

Vidar has additional tricks - a way to dump the IPFW BAD table and a way
to import it later - you can keep this database of shame up to date on
all those miscreants and keep them away. You can even import the BAD
table on another FreeBSD system running IPFW. Also, there’s a handy
audit script that lets you compare the entries in the database with what
is actually in the IPFW BAD table. Also, Vidar keeps the evidence of the
event in question that resulted in blocked access. Finally, using SEC
rules, you can make the block last for an hour (for a misconfigured
remote system) or a day (for a script kiddie), or permanently (for a
determined hacker), or any length of time you choose.

There is also a feature to check live processes and alert if, for
example, the vi editor is running at 2:00am in the morning.

Jim Brown is a long time BSD aficionado who currently lives in Durham, NC.

Nearest NYC Subway is the 14th Street/Eighth Avenue station L, A, C, E.

To get to the backroom, you must enter the front door, follow the long
bar on your left, and walk all the way to the back. At the rear of the
BrassMonkey, you will see an alcove for the 3 bathrooms our room is off
to your right.