Adaptive firewall experiences - and a kludge to work around it

Question

I had a vexing issue with Leopard Server and clients with incorrect passwords. We'd, seemingly, after one password attempt get blocked by the server for all traffic. What is likely happening is the client is trying several different attempts (more on that in a sec) and hitting the 10 password failure limit in the Adaptive Firewall code. This block would through the client into the penalty box for 15 minutes.
Sources of password failures would be things like a windows user with Thunderbird client and the wrong SSL setting. Or a AFP client with password stored in Keychain. Even Apple Mail or iCal with stored password were enough to cause a lock out.
I did call tech support but figured out things on my own. It seems that there's a firewall rule being automatically inserted on such an 'attack' to the server. They're numbered 01700 and above. The "ipfw delete ####" command (as root) will delete the offending firewall rule and allow things to return to normal.
So for now - I have a root window running this script:
#!/bin/sh
while "true"
do
sleep 5
ipfw list|grep '^017'|awk '{ print "ipfw delete " $1 }'
ipfw list|grep '^017'|awk '{ print "ipfw delete " $1 }'|sh
done
which will delete any firewall rules with numbers starting with 017. Perhaps this will increase past 01799 - I'll examine if the problem continues to vex us. I suppose I could run this as a cron job but a 1 minute delay is not as friendly as 5 seconds.
With this bandaid out there - anyone know a better solution? I do see mention of the "optional adaptive firewall" but it looks like the optional part has gone away. Personally don't need quite that level of paranoia here.

Answer 1

The adaptive firewall kicks in differently for different classes of services. For ftp & ssh it looks at log scrapings from /var/log/secure.log and counts each auth failed message as a "strike". For other services, such as AFP & mail, it gets info from the password server, again each failure there counts as one "strike". Unfortunately ssh and ftp tend to spit out several log messages when they get an auth failure, this makes the adaptive firewall system hypersensative to those services.
The earlier Leopard releases had another problem where things were blocked on the second strike. I believe that has been fixed by now (10.5.3).
As has been mentioned above there is a way to tune the sensitivity (number of strikes) and the duration of the blocking in the rules file (only if the second strike problem is fixed obviously).
- Leland