Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I administer a web server and recently we had our IP banned (!) from our host after they received a notification e-mail for abuse. In particular our server is allegedly involved in spam attacks over HTTP. The content of the abuse report email we received was not much informative - for example the IP addresses our server is supposed to have attacked against are not included - so I started a wireshark session checking for suspicious traffic over TCP/HTTP while trying to locate possible security holes on the system. (Let me note that the machine runs a Debian OS).

Here is an example of such a request...

Source: 89.74.188.233
Destination: 12.34.56.78  // my ip
Protocol: HTTP
Info: GET 'http://www.media.apniworld.com/image.php?type=hv' HTTP/1.0

I manually blacklisted this host (as well as some other ones) blocking them with iptables, but I can't keep on doing manually all day long... I'm looking for an automated way to block such IPs based on:

  1. Statistical analysis, pattern recognition or other AI-based analysis (Though, I'm reluctant to trust such a solution, if exists)
  2. Public blacklists

Using DNSBL I actually found out that 89.74.188.233 is blacklisted. However other IPs which are strongly suspicious like 93.199.112.126 (i.e. http://www.pornstarnetwork.com/account/signin), unfortunately were not blacklisted! What I would like to do is to automatically connect my firewall with DNSBL (or some other blacklist database) and block all traffic towards blacklisted IPs or somehow have my local blacklist automatically updated.

Update 1: My main question here consists in configuring iptables to automatically block all IPs that are blacklisted in a public database such as this one. I'm looking for a tool that will automatically update my local blacklist adding any blacklisted IPs and of course removing them once their issues have been resolved (Would not be nice to block forever an IP because it once happened to be blacklisted). I don't really understand the utility of a blacklist web service without the ability to be consumed by iptables.

share|improve this question
add comment

2 Answers

I would first make sure that you've not unintentionally become an HTTP proxy that people are using to relay mail through.

share|improve this answer
    
According to checkor.com the server is not an open relay and I don't have a proxy server running. Which is the most reliable way to verify if something has gone wrong? –  Pantelis Sopasakis Mar 14 '11 at 17:08
    
Checkor.com appears to only check SMTP relay. I would 1) portscan the machine in question with nmap, and see what ports are really open, 2) check that against the results of "netstat -an" on the machine itself. If you find a difference, you may have malware or a rootkit running. Check your http server with checker.freeproxy.ru/checker/index.php or a similar tool, as well. Do you forward mail for anyone, as in "localuser: user@remote-system" in your alias file? That can sometimes end up generating abuse reports, because your ip is in the received msg header chain. –  malcolmpdx Mar 14 '11 at 22:14
    
I noticed that the server is blacklisted in ahbl.org/lktool with the message: "127.0.0.3 - Open Proxy - This host has been detected as an open proxy. This means that the machine allows others to use the machine in question to 'relay' or 'bounce' their traffic.". I'm investigating further to find the root of the problem. I used to have a squid and an MTA in order to send notification emails to the administrators. I'm suspecting squid - How can I secure it? –  Pantelis Sopasakis Mar 15 '11 at 1:05
    
Make sure squid is off, if you're not using it, and not configured to restart automatically. If you are using it, I would read the docs and google "securing squid" and you'll get what you need. –  malcolmpdx Mar 18 '11 at 16:36
add comment

Are you running anything that acts as a HTTP proxy on your machine? If you do, look at locking atht down. If not, investigate your machine as a whole. Unless you have explicitly allowed random code to run on your server, you may be looking at a compromised machine.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.