Re: Alert!!

[Dale Sykora <dalen@xxxxxxxxxx>]

Christopher K. Johnson wrote:
> Dale Sykora wrote:
>
> > Alexandar,
> >     I want to thank you for all your thougful participation on this 
> > list. Your words or wisdom have helped me on numerous occasions.  Do 
> > you know of any SIPTO type program or script?  SIPTO (which I just 
> > made up) means Source IP Time Out (think child behavior deterant).  It 
> > would watch the logs for admin defined bad behavior from a connecting 
> > IP and then temporarily ban that IP (time-out via iptables) for 15 
> > minutes or so after 3 occurances in a given time frame.  For example, 
> > SME server adds a denylog line to /var/log/messages when an external 
> > IP tries to connect to a closed port.  I would like something to watch 
> > this 'tail -f?' and add an iptables rule to drop all connections from 
> > this IP address for a short time frame (extendible if other attemps 
> > are made).  I would like this to be generic enough to shut down access 
> > to zombies that try and send viruses thru my email server, or systems 
> > that think I run IIS and look for cmd.com/etc... as well.  Someone it 
> > the past mentioned an IDS, but that seems CPU/network intensive.  I 
> > simple want to watch the logs and block the bad/zombie machines that 
> > tend to fill the logs.
> > Any suggestions?
> >
> > Thanks,
> >
> > Dale 
>
>
> Are you running iptables that you can alter on this firewall?
> If so then you might take a look at the limit module for starters.  e.g.:
> # Logging what falls off the end of INPUT chain - but rate limited
> -A INPUT -i eth+ -m limit --limit 1/s --limit-burst 60 -j LOG 
> --log-prefix IPTABLES_DROPPED:
>
> The rule will log any packets input to the firewall on any ethernet 
> interface that were not already dropped or denied or accepted.  But it 
> will only log an average of one message per second, or less.  Up to 60 
> may be logged in the first second, but any that are will deplete the 
> burst by that amount.  And the burst counter only builds back up at 1/s 
> to a maximum of 60.
>
> It is not specific to a particular set of annoying system ip addresses, 
> but applied equally to all packets passing that rule.
> On the other hand it doesn't need any log watching or dynamic response 
> mechanism.
>
> Chris
I am running iptables (SME is a RH7.3 derivative).  I'll look into this. 
 It doesn't cover the mail/web server hits, but it is a start.

Thanks,

Dale