shiryu38 at gmail.com
Sat Aug 23 10:30:30 BST 2008
Yet another question...my mind is actually shared between fail2ban and
sshblack to perform the blacklisting work.
My server is basically a web server, so I may also face non SSH attacks.
Any advice ?
> 2008/8/20 Martin Minka <martin.minka at gmail.com>
>> it is up to you how you change $ADDRULE and $DELRULE in sshblack.pl
>> be aware that you need to restart firehol after you change your blacklist
>> or combine my and your aproach and change in sshblack.pl:
>> my($ADDRULE) = 'echo "ipaddress" >> /etc/firehol/blacklist; /sbin/iptables
>> -I BLACKLIST -s ipaddress -j DROP';
>> my($DELRULE) = ''; # IP will be blocked until you dont delete it manualy
>> don't forget to add to begin of your /etc/firehol/firehol.conf
>> iptables -N BLACKLIST
>> iptables -A INPUT -p tcp -m tcp --dport 22 --syn -j BLACKLIST
>> shi ryu wrote:
>>> Thanks Martin,
>>> I'm actually not very familiar to IPtables and I am already using the
>>> blacklist feature of firehol.
>>> Here is what I have currently in my firehol.conf :
>>> - blacklist these `cat /etc/firehol/blacklist`
>>> and then the plain text file /etc/firehol/blacklist where I add manually
>>> the IPs to be blacklisted.
>>> Is there a way that I can have sshblack adding its ip addresses to the
>>> same file (etc/firehol/blacklist ) I am using now ?
>>> 2008/8/20 Martin Minka <martin.minka at gmail.com <mailto:
>>> martin.minka at gmail.com>>
>>> I am using this in my firehol.conf:
>>> # add support for sshblack.sh
>>> iptables -N BLACKLIST
>>> iptables -A INPUT -p tcp -m tcp --dport 22 --syn -j BLACKLIST
>>> On Wed, Aug 20, 2008 at 9:14 AM, shi ryu <shiryu38 at gmail.com
>>> <mailto:shiryu38 at gmail.com>> wrote:
>>> Hi there,
>>> has anyone ever tried to use SSHBlack
>>> (http://www.pettingers.org/code/sshblack.html) in a firehol
>>> context ?
>>> That tool looks awesome to automatically block SSH brute forces
>>> and it uses IPtables to perform its job.
>>> Best Regards,
>>> This SF.Net email is sponsored by the Moblin Your Move
>>> Developer's challenge
>>> Build the coolest Linux based applications with Moblin SDK & win
>>> great prizes
>>> Grand prize is a trip for two to an Open Source event anywhere
>>> in the world
>>> Firehol-support mailing list
>>> Firehol-support at lists.sourceforge.net
>>> <mailto:Firehol-support at lists.sourceforge.net>
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Firehol-support