After diving into the Adaptive Firewall once more I got the impression that the whole system is flawed and the documentation is a mess.
.../hb_summary apparently doesn't work at all because it seems to rely on the file /private/var/db/af/blockedHosts getting populated
by ipfw which isn't activated in 10.9 (and wouldn't work with the 400.AdaptiveFirewall anchor). pf doesn't use the file blockedHosts at all.
The best you can do is the following:
Enable the Adaptive Firewall service
sudo /Applications/Server.app/Contents/ServerRoot/usr/sbin/serverctl enable service=com.apple.afctl
Populate the whitelist with
sudo /Applications/Server.app/Contents/ServerRoot/usr/libexec/afctl -c
Define max bad auth attempts (e.g. 3) and ban time (e.g. 60 minutes)
sudo /Applications/Server.app/Contents/ServerRoot/usr/libexec/afctl -T 3
sudo /Applications/Server.app/Contents/ServerRoot/usr/libexec/afctl -H 60
This will modify the file /Applications/Server.app/Contents/ServerRoot/private/etc/emond.d/rules/AdaptiveFirewall.plist.
Check the mod with:
sudo grep -m 2 -A 4 hostBlockThreshold /Applications/Server.app/Contents/ServerRoot/private/etc/emond.d/rules/AdaptiveFirewall.plist
- Relaunch emond:
sudo killall emond
Add known bad hosts for a long time:
sudo /Applications/Server.app/Contents/ServerRoot/usr/libexec/afctl -a 220.127.116.11 -t 1000000
(Please be aware of the y2038 problem).
This will modify the file /private/var/db/af/blacklist. Hosts added here usually don't survive a reboot.
- Start af with
sudo /Applications/Server.app/Contents/ServerRoot/usr/libexec/afctl -f
To get blocked hosts enter:
sudo pfctl -a com.apple/400.AdaptiveFirewall -t blockedHosts -T show -vvv
To get pf's state enter
sudo pfctl -s all.
This is tested with hostile
openssl s_client -connect imapserver_ip:993 login attempts.
After a reboot the
.../afctl -f command will start pf and af but in at least one of two cases it doesn't block hostile login attempts though it's announced in the log file.
After modifying the keys debugLevel and logEvents in the file /etc/emond.d/emond.plist,:
creating the file /System/Library/LaunchDaemons/com.apple.afctl_boot.plist with the content:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
and loading it with:
sudo launchctl load /System/Library/LaunchDaemons/com.apple.afctl_boot.plist
it seems to work more reliably. The Adaptive Firewall will be loaded at boot time. No further afctl launch command is required!