Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

ControlScan's PCI compliance scan is running on one of the hundreds of websites that I have on my Amazon Web Services server, but is slowing or bringing down the whole server.

What suggestions do you have to block this scan?

share|improve this question
1  
Use iptables to block the host or hosts running the scan? –  MadHatter Apr 4 '13 at 5:54
    
It looks like iptables will allow new connections to be blocked but not existing ones. Any thoughts on how to block all connections from specific IPs? –  william tell Apr 4 '13 at 6:00
5  
Stop paying them? –  Michael Hampton Apr 4 '13 at 6:01
2  
Sorry, but that's simply not right about iptables. If you block all packets from an address, you block those which are part of existing connections as well as new ones. It's certainly possible to craft a rule that only blocks new connections, but that's neither a requirement nor a limitation in iptables. –  MadHatter Apr 4 '13 at 7:04
2  
If a PCI compliance scan is crashing your server, figure out why and fix it. Less pleasant folks than ControlScan will be happy to crash you in the same manner. –  ceejayoz Apr 4 '13 at 14:00
show 2 more comments

3 Answers

You could add an explicit DROP at the beginning of INPUT table

iptables -I INPUT 1 -s ip.add.re.ss -j DROP

This will drop all existing connections from ip.add.re.ss and not allow new ones from it either.

share|improve this answer
    
EC2 security groups don't allow you to block IPs in this manner, and blocking (in iptables or otherwise) is just going to piss off whichever of OP's clients is trying to do a vulnerability scan against their site (something that should be perfectly acceptable as a web hosting client). –  ceejayoz Apr 4 '13 at 14:44
1  
@ceejayoz: Thanks - it's a while since I played with EC2 and I misremembered the security group stuff. Regarding the rest, it answers the OPs question which is how to block the scan. Whether this annoys his (supposed) customer or not wasn't (and isn't) of concern to me. –  Iain Apr 4 '13 at 14:57
add comment

We use them for PCI.

They have a cancel button to stop running scans on your site. Also they have three different scan speeds.

Maybe try a slower scan.

share|improve this answer
    
I'd guess it's not the OP's scan, but one of his clients testing their websites for vulnerabilities. –  ceejayoz Apr 4 '13 at 14:21
1  
That makes sense but blocking scans via ip tables will prevent clients from ever getting compliant. Much better to educate the clients on how and when to perform scanning. I also think that if one scan brought the server down, there are stability or resource issues within the infrastructure. –  user167841 Apr 4 '13 at 14:42
add comment

ControlScan crashes our server as well (even on the 'slow' setting). This is doubly annoying since, on the slow setting, the scan takes almost four days so when the server crashes...the scan fails and we have to start all over. Our application might not be the most efficient ever, but this is on a relatively new, dedicated server that has no problems with any other traffic.

We've brought the matter to ControlScan's attention but they don't seem interested in fixing it by adding a slower scan speed option. Most of their requests during the scan process seem relatively well paced, but there appears to be one particular section of their logic (blind SQL injection or XSS probing I think) that runs too fast (we've logged almost 100 requests a second from them during this piece). They really, really need to work on their code...and maybe add a 'very slow' setting. Their solution was to offer to sell us some sort of hosted firewall product / solution (I can't remember how much it cost a month)...we weren't interested.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.