Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running a series of web servers and already have a pretty good set of firewall rules set up, however I'm looking for something to monitor the traffic and add rules as needed. I have denyhosts monitoring for bad SSH logins, and that's great - but I'd love something I could apply to the whole machine that would help prevent bute force attacks against my web applications as well, and add rules to block IPs that display evidence of common attacks.

I've seen APF, but it looks as though it hasn't been updated in several years. Is it still in use and would it be good for this? Also, what other solutions are out there that would manipulate iptables to behave in some adaptive fashion?

I'm running Ubuntu Linux, if that helps.

share|improve this question
add comment

4 Answers

I'm a really big fan of fail2ban

http://www.fail2ban.org/wiki/index.php/Main_Page

Here is a list of the main features available in Fail2ban.

Client/Server architecture.
Multi-threaded.
Highly configurable.
FAM/Gamin support.
Parses log files and looks for given patterns.
Executes commands when a pattern has been detected for the same IP address for more than X times. X can be changed.
After a given amount of time, executes another command in order to unban the IP address.
Uses Netfilter/Iptables by default but can also use TCP Wrapper (/etc/hosts.deny) and many other actions.
Handles log files rotation.
Can handle more than one service (sshd, apache, vsftpd, etc).
Resolves DNS hostname to IP address. 
share|improve this answer
add comment

Learn about ipset, from the makers of iptables.

Then, learn how to use the -j SET target; preferably in combination with -m recent -m limit and/or -m hashlimit.

Good luck, young Jedi! :-)

(Since you're using Ubuntu, you must install ipset from source; see my blog for the HOWTO: http://pepoluan.posterous.com/powertip-howto-install-ipset-on-ubuntu )

share|improve this answer
    
In 12.04LTS, ipset is in the universe repository. sudo apt-get install ipset. –  mivk Nov 16 '13 at 13:00
add comment

It a little bit overkill but there are great project called OSSEC, it can monitor server logs and if it sees something fishy (it has list of rules plus you can write your own) it can block remote IP.

You can not call it iptables daemon, but it is way more powerful then denyhost.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.