Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Are there any IP address blacklisting programs for Linux servers that allow the administrator to specify certain conditions that trigger an iptables blacklist on IP addresses scanning for vulnerabilities?

Example:

An IP address scans my web server for every default URL of phpMyAdmin. That's obviously a bot I don't want to be communicating with my server, so I'd like to blacklist its IP address for a day.

What options do I have for stopping those bots?

share|improve this question

5 Answers 5

up vote 6 down vote accepted

There are multiple tools in this space; however, I urge caution using them as many have been found to have exploits that make them worse than not having them.

You will also need to decide what service you are protecting. HTTP, SMTP, POP, etc. have different tools.

For example, fail2ban: http://www.fail2ban.org/wiki/index.php/Main_Page

Can be customized to block on various log hits.

share|improve this answer
    
Thanks I thought fail2ban was mainly for password failures nice to know it highly customizable. –  JMC Jan 6 '12 at 5:48

You can use fail2ban. It has a lot Configurations Options and can block ips automatically.

share|improve this answer

I can sugest you to use csf[Config Security and Firewall] software. Because, it has the lot of features such as POP3/IMAP login tracking , Ip-Blocking, LFD , mod-security and so on.

Here is the link to refer the csf.

share|improve this answer
    
We have seen issues with CSF under aggressive DOS attacks. The problem appears to be the verbose logging of CSF (or APF) during these attacks. On systems with little spare disk IO, I have seen this be enough to take down the server. –  jeffatrackaid Dec 30 '11 at 19:48

Take a look at Port Sentry, been around a long time and most distro's have it in their package management system by default. Listens on configured unused ports (e.g Telnet 23) and iptables bans connections to those configured ports.

share|improve this answer

Its not the most elegant solution but is probably more flexible. Use a combination of Snort, custom rules looking for targeted attacks, and then SnortSam in order to create custom firewall rules. https://www.ibm.com/developerworks/web/library/wa-snort2/ http://codeidol.com/sql/network-security-hack/Network-Intrusion-Detection/Automatically-Firewall-Attackers-with-SnortSam/ Fail2ban is obviously an option, http://blog.shadypixel.com/spam-log-plugin/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.