Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a web server serving public pages under a continuous barrage of requests attempting to login with various combinations of credentials. I would like to thwart these by blocking IP addresses and ports. From the Security log I can see the IP address and port where these requests eminate, and I have selectively blocked various IP addresses. However, if I can block a range of ports that would be much more efficient.

So here are my questions...

1) Is blocking IP addresses and ports the best strategy? Or is there a better strategy?

2) Can someone provide a standard list of ports that must remain open for the web server to function properly? ie, port 80 obviously must remain open. I am looking for a consolidated list of standard ports for web, ftp, mail, and other services.

share|improve this question
    
Well typically a web server needs port 80 and possibly port 443 open. FTP would make it an FTP server and email (25, 110, etc.) would make it an email server. Short of using and IDS/IPS you're going to find trying to block ip addresses/blocks is going to get cumbersome and counter-productive very fast. –  joeqwerty Jul 13 '13 at 13:45
1  
I up voted your question because the first part of it is important - "What is an effective way to deal with the barrage of bogus/malicious connections while trying to provide a publicly available service on the internet?". The second part of your question isn't so good. If you're going to host a web site then you owe it to yourself and your users/customers to know what ports should be open for a web site (your web site specifically) and you should know the difference between a web server, and FTP server and an email server and you should know what ports are utilized for each. –  joeqwerty Jul 13 '13 at 14:48
1  
Just because it's a web server doesn't implicitly or automatically make it an FTP or email server. You could certainly host FTP and email on your web server but you should know the difference between hosting a web site, operating an FTP server and operating an email server. –  joeqwerty Jul 13 '13 at 14:49
add comment

1 Answer

up vote 1 down vote accepted

1) Yes and no. Blocking IPs work great to thwart off brute force attacks but never should be seen as security.

2) You could run a netstat command and see what you have running and what you need to leave open. This would allow time to do a full audit anyway and see what you could also disable. The list varies depending on what you are running and how things are setup.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.