Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm getting a ton of bruteforce attacks today from a domain rather then an IP. I tracked down the websites IP address and blocked it but I am still getting the bruteforce warnings. Can I some how use iptables to block a domain name?

alumni.xjtu.edu.cn
share|improve this question
    
brute force against what? HTTP? SSH? FTP? –  SpacemanSpiff Nov 12 '12 at 22:09
    
@SpacemanSpiff I would guess SSH, but i'm not sure. This is the message I get. 5 failed login attempts to account root (system) -- Large number of attempts from this IP: alumni.xjtu.edu.cn –  Michael Howey Nov 12 '12 at 22:13
    
I've been getting them every 5 minutes for the last 10 hours. Normally I block the IP and I'm good to go. @SpacemanSpiff –  Michael Howey Nov 12 '12 at 22:14

3 Answers 3

up vote 1 down vote accepted

You may want to consider doing a reverse DNS query, then a whois query do determine the network block and finally just drop the whole network block.

Commands:

host alumni.xjtu.cn
alumni.xjtu.edu.cn has address 202.117.3.104

whois 202.117.3.104
inetnum:        202.117.0.0 - 202.117.63.255
netname:        XJTU-CN
descr:          Xian Jiaotong University
descr:          Xian
descr:          Shanxi Province
...

iptables -A INPUT -p tcp --source 202.117.0.0/17 -j DROP

No more TCP connections from the whole university.

share|improve this answer
    
So basically run this line in putty? iptables -A INPUT -p tcp --source 202.117.0.0/17 -j DROP –  Michael Howey Nov 12 '12 at 23:06

Use a tool like fail2ban to automatically detect and ban these brute-force login attempts.

share|improve this answer

Ban 202.117.3.104. This IP has a PTR record (reverse dns) and it resolves to alumni.xjtu.edu.cn. Reverse DNS

share|improve this answer
    
Tried that, didn't work –  Michael Howey Nov 12 '12 at 22:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.