<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2802" name=GENERATOR></HEAD>
<BODY style="MARGIN-TOP: 2px; FONT: 10pt Arial; MARGIN-LEFT: 2px">
<DIV>Jason,</DIV>
<DIV>I would be interested in having a look at this if possible.</DIV>
<DIV> </DIV>
<DIV>Thanks<BR><BR>>>> jason@mindsocket.com.au 5:36:46 pm 19/01/2006
>>><BR>> I've had 125.234.250.153 knocking at my port 53 all
night. Suggestions?<BR><BR>I'm not sure whether what I'm about to dive
into below is useful in this<BR>particular situation. But attacks are certainly
common and some people<BR>may find this useful:<BR><BR>There are definitely
cases were a simple firewall rule isn't going to<BR>suffice to block attackers
since the service may need to be open to the<BR>Internet for general use. ssh is
a good example. Ideally if someone<BR>begins an attack then you want to block
access automatically preventing<BR>further attacks.<BR><BR>I wrote a an IP
blocking utility that maintains an iptables<BR>blacklist. As long as there is
some log for the script to tail which<BR>identifies the host by IP and some way
to differentiate lines we're<BR>interested to other lines then it'd be easy to
write a new handler. At<BR>the moment I have 3 handlers:<BR><BR>-
ssh<BR><BR> our hosts are open to the internet since we access
them from all<BR> over the place (hotels, etc...). We get a
TON of attacks, this has<BR> significantly cut down on attacks
usually blocking them within a<BR> minute (and sooner if I
reduced the sample frequency).<BR><BR>- portal<BR><BR> this is
a proprietary app, but really it's an apache access log<BR>
handler identifying attacks by 2 methods, either too many
error<BR> requests or .php|.jsp type requests (none of the
pages are .php or<BR> .jsp so i can easily identify these as
attacks). Same as above, we'd<BR> get so many attacks that
eventually it'd lead to some quirkiness in<BR> portal
requiring a restart every now and then.<BR><BR>- sync<BR><BR>
now this handler is cool, basically you can have IP blocking
tools<BR> running on multiple hosts with a shared pool of
blocked IPs. i.e. an<BR> IP is blocked on host A which is
communicated to all other hosts.<BR><BR>Other notable points:<BR><BR>-
whitelist, these IPs are never banned<BR><BR>- iptables is maintained
automatically. i.e. script will add a blacklist<BR> chain and make sure
it's in the input chain (if necessary), and also<BR> maintain the list of
IPs in the blacklist chain.<BR><BR>- script loads and saves it's config<BR><BR>-
blocked IPs expire out after 72hrs (configurable). We don't want the<BR>
list to grow out of control for ever.<BR><BR>Script is written in Perl and seems
to use virtual nil resources on my<BR>hosts. However that would depend on sample
frequency, number of logs<BR>you're looking at, and rate of entries written to
the logs.<BR><BR>Unfortunately I haven't had time to put this up, or document
it, and of<BR>course there are probably environment specific things in there.
However,<BR>if you are interested then let me know and I'll get you a
copy.<BR><BR><BR>Jason
Nicholls<BR>_______________________________________________<BR>PLUG discussion
list: plug@plug.org.au<BR><A
href="http://www.plug.org.au/mailman/listinfo/plug">http://www.plug.org.au/mailman/listinfo/plug</A><BR>Committee
e-mail: committee@plug.linux.org.au<BR></DIV></BODY></HTML>