Some of our users are launching port scans on Internet servers. These users connect to our servers using ssh and openvpn. We obviously suspend their accounts where appropriate however I'd like to find a technical solution that either prevents the scan or discourages them (e.g. by slowing it down).
The best solution I have come up with is (which is aimed at SYN scanning):
# Log suspected port scanners iptables -A Limit_Pscan -p tcp --syn -m state --state NEW -m recent --name port_scan --rcheck --seconds 10 --hitcount 30 -j LOG --log-prefix 'PORT SCANNER(?): ' # Drop connections where packets > 29 in 10 second period. iptables -A Limit_Pscan -p tcp --syn -m state --state NEW -m recent --update --name port_scan --seconds 10 --hitcount 30 -j DROP # Allow and add the source address of the packet to the port_scan list iptables -A Limit_Pscan -p tcp --syn -m state --state NEW -m recent --set --name port_scan
However this obviously catches a lot of legitimate traffic. In my testing if I restart my browser with a few dozen tabs it opens enough connections that most of the tabs timeout. I can't seem to find a balance and am thinking that perhaps there is a better way. Any ideas?