I have been enumerating the remaining security concerns on one of my back-end production servers, when I came to the realization that something which could be incredibly useful was missing from my operating systems upstream repository.
I have been looking for a PAM Module, which checks the Remote Host IP address against a DNS Block List (DNSBL).
My use case is that... While IDS Software can respond after detecting an probe, vulnerability scan, or brute force attack-
some services (i.e. Apache2, proFTPd, Sendmail, SpamAssassin)
include a DNSBL module or feature, which help vastly decrease the number of machines that can participate in an attack. it does this by blocking known infected or zombie machines, public proxies, and TOR exit relay nodes (for example).
Others, to my knowledge, do not. Dovecot/Saslauthd
do not include such functionality. These are frequently targeted in brute force attacks on my network. these service are still covered by the IDS system, but suffer a large majority of the attacks.
With a PAM Module that checks the remote host IP, during authentication, against a DNSBL... effectively ALL services could have this extra layer of resilience against a distributed brute force attack, or probe (limiting the possible machines that can be used in said attack)
I am wondering if there is an existing PAM Module to serve this purpose? and if not, why has this been overlooked by developers?
It would be an incredibly simple module, which (in my opinion) could serve a great purpose..
For now, I have wrote a script which interfaces with PAM (via the "pam_exec.so" module). For some reason, this is not working (simply causes BASH to crash). When I get the chance, I plan to try the "pam_script.so" module instead..
I would be willing to write a PAM Module to do this, but am not sure how hard it is to get a piece of software into the Debian or Ubuntu Repositories.
Thanks