fail2ban, thats a good one, gotta save that link.

try the gui to iptables;

http://www.fwbuilder.org/

On Oct 9, 2009, at 11:39 AM, Toby Bluhm wrote:

Niki Kovacs wrote:

...

Hi,

I just set up a web server... and my bandwidth is being eaten by some chinese folks trying to brute-force-ssh their way into the machine.

Is there a simple way to banish either single IP addresses or, maybe even better, whole IP classes ? I know it's feasible with iptables, but is there something more easily configurable ?

Cheers,

Try fail2ban from rpmforge.

-- tkb _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

Toby Bluhm wrote:

Toby Bluhm wrote:

...

Niki Kovacs wrote:

...

I just set up a web server... and my bandwidth is being eaten by some chinese folks trying to brute-force-ssh their way into the machine.

Is there a simple way to banish either single IP addresses or, maybe even better, whole IP classes ? I know it's feasible with iptables, but is there something more easily configurable ?

<snip> Let me note that at work, the security group has a script set up that does it automagically, after so many attempts.

And every morning or two in the logs, I see attacks from China, or Mexico, or Spain, or Taiwan... but then, we are a well-known site.

mark, supporting the NIH

There is an iptables geoip module to allow you to specify countries. I never used it thought.

The advantage of denyhosts is that it not only bans addresses but also shares banned hosts with a network of a few thousands of installations (an opt-in option), so you are not on your own.

Moving ssh to a none standard port is the best thing you can do under the circumstances you describe, IMHO.

Another option might be to tar-pit attackers (using iptables) - that way you can slow down their traffic so hopefully they'll eat less of your bandwidth.

-Amos

On 10/10/09, Toby Bluhm tkb@alltechmedusa.com wrote:

Toby Bluhm wrote:

...

Niki Kovacs wrote:

...

Hi,

I just set up a web server... and my bandwidth is being eaten by some chinese folks trying to brute-force-ssh their way into the machine.

Is there a simple way to banish either single IP addresses or, maybe even better, whole IP classes ? I know it's feasible with iptables, but is there something more easily configurable ?

Cheers,

Try fail2ban from rpmforge.

Also, if you're using the standard fw that ships with centos, you can stop entire blocks of IPs by manually inserting rules after iptables starts:

iptables -I RH-Firewall-1-INPUT 1 -s 1.2.3.4/24 -p tcp --dport 22 -j DROP

IP ranges by country: http://www.countryipblocks.net/country-blocks/select-formats/

The IP ranges will change from time to time, so you have to check often. You could script in a download from http://www.countryipblocks.net/continents/ to keep it current.

Like someone said, if you have to keep ssh open to the world, changing the port number will dramatically cut down on the attempts.

-- tkb _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

On Mon, Oct 12, 2009 at 9:36 PM, nate centos@linuxpowered.net wrote:

Amos Shapira wrote:

...

There is an iptables geoip module to allow you to specify countries. I never used it thought.

I love linux, been using it for about 14 years but a good firewall it does not make..

http://www.openbsd.org/faq/pf/tables.html

"A table is used to hold a group of IPv4 and/or IPv6 addresses. Lookups against a table are very fast and consume less memory and processor time than lists. For this reason, a table is ideal for holding a large group of addresses as the lookup time on a table holding 50,000 addresses is only slightly more than for one holding 50 addresses [..] Tables can also be populated from text files containing a list of IP addresses and networks:

table <spammers> persist file "/etc/spammers"

block in on fxp0 from <spammers> to any [..] Tables can be manipulated on the fly by using pfctl(8). For instance, to add entries to the <spammers> table created above:

# pfctl -t spammers -T add 218.70.0.0/16"

--

Myself I'd be interested in seeing a iptables system running with 50,000 rules for matching against.

nate

---

CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos

That's why i was recommending ipset earlier.

Toby Bluhm wrote:

Try fail2ban from rpmforge.

The main problem with fail2ban is that it's based on Python, so it takes a fair bit of memory. This isn't a big problem on a dedicated server or on a system with swap, but a lot of these attacks are made against shared servers or those running virtual machine schemes like OpenVZ, which don't allow swap, so you don't have enough memory to run something so heavy.

What I do on my VPS is periodically look at the logs and ban attackers by hand with this script, which I call iptdrop:

DROPFILE=/etc/network/iptables-drops if [ -n "$1" ] ; then iptables -I INPUT -s "$1" -j DROP echo $1 >> $DROPFILE else echo usage: $0 ipaddress echo exit 1 fi

Then in /etc/rc.local:

while read ip ; do iptables -I INPUT -s "$ip" -j DROP done < /etc/network/iptables-drops

That restores any bans on reboot.

After a week or three, I remove the IP from the list, on the theory that it might be some bot-infested PC behind DHCP, and so has probably moved on.