Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One of my server logs showed there was an unauthorized access attempt on a daemon listening on a non-standard port. That led me to wonder how often people run port scanners to look for vulnerabilities. Is there a program I can run as a honeypot to automatically ban IPs that scan certain ports?

share|improve this question
2  
Don't mention the OS, that would take up too much space. –  niXar Aug 30 '09 at 20:24
2  
And making sarcastic comments helps nobody –  Mark Henderson Aug 30 '09 at 22:01

4 Answers 4

You could write something for fail2ban to parse iptables rules, and ban ips that hit particular ports.

share|improve this answer
    
+1 iptable rules. Rate limiting is very easy and useful see this link: geocities.com/youssef116/writing/ratelim.html ;-) –  ForgeMan Aug 31 '09 at 0:59

Heh... pimping OSSEC once again, but check it out. It can automatically run scripts (and update firewall rulesets on Linux/BSD almost out of the box) when specific syslog patterns are noted: http://ossec.net

share|improve this answer

You should expect a machine on the Internet to be scanned basically continually.

Automatically banning IPs that scan certain ports is not what a honeypot is.

The attackers have access to multiple networks. You can't block them. You can frustrate a portscanner, but if the goal is to frustrate people scanning your network and not add security, your best solution is a honeypot.

But you don't know what one is and I really doubt you want to set one up. Your question indicates that you should study some security and networking basics. Setting up honeypots is one road to better understanding of information security.

To get actual help for systems problems, or really any technical problem in any field, you should describe the situation and where you want to end up. Designing a solution when you know little about what's going on, and asking for implementation assistance with small details, is a sure sign of a project that will end in failure.

share|improve this answer

I don't know what OS you are running, but certain firewalls have the ability to create rules that allow you to automatically ban a user if they hit a certain port within a certain amount of seconds.

The other option is to run a script of some sort that reads the log file, and when it sees attempts on the ports in question that it automatically adds a new entry to the firewall to keep them out.

Port scanning is just a fact of life, if this service is supposed to be available to only certain people, then adjust your firewall so that everything but that what is allowed to access it is blocked, basically creating a whitelist rather than blacklisting. Whitelisting is more effective, but at the same time more of a pain to maintain.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.