<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">G'day,<br>
<br>
Don't use F2B, but do have a custom bit of code that tracks
attempts to connect and if invalid they get blocked.<br>
I block about 359 in a 24 hour period and after a secret
predetermined number of attempts they get blocked on a permanent
basis about 37 in a 24 hour period<br>
Currently have 13238 ip's listed that are blocked on ssh and mail
ports.<br>
<br>
On average it permanently blocks about 1000 IPs a month<br>
<br>
On 09/05/2021 08:00, William Kenworthy wrote:<br>
</div>
<blockquote type="cite"
cite="mid:17c662ad-8866-4de7-9486-4318d5269ce8@iinet.net.au">
<pre class="moz-quote-pre" wrap="">Hi Brad,
I am finding firewalling in general is a big pain these days and getting
less and less useful because of phones and IoT devices.
BillK
On 9/5/21 2:10 am, Brad Campbell wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">The release of the 21nails vulnerability list got me to get off my backside and upgrade a few servers. A job I've been putting off for "a while" (read as nearly a year past "end of support"). The additional default logging identified a swathe of attacks against the SMTP servers that, while I was aware of I never really paid attention to the magnitude.
As a result I finally installed fail2ban. Within half an hour of installing fail2ban I observed the attacks had changed in nature explicitly to evade the default fail2ban behaviour (on debian/devuan, 5 hits in 10 minutes gives a 10 minute ban). I altered the default jail time from 10 minutes to 60 minutes, and the bloody attacks adapted again. I know it's not just them hammering the port until fail2ban removes the iptabes rule as I've watched it happen with tcpdump.
These bots are getting clever!
Brad
</pre>
</blockquote>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
'ooroo
Stinga...(:)-)
---------------------------------------------------
Email: <a class="moz-txt-link-abbreviated" href="mailto:stinga@wolf-rock.com">stinga@wolf-rock.com</a> o
You need only two tools. o /////
A hammer and duct tape. If it /@ `\ /) ~
doesn't move and it should use > (O) X< ~ Fish!!
the hammer. If it moves and `\___/' \) ~
shouldn't, use the tape. \\\
---------------------------------------------------</pre>
</body>
</html>