ControlScan's PCI compliance scan is running on one of the hundreds of websites that I have on my Amazon Web Services server, but is slowing or bringing down the whole server.
What suggestions do you have to block this scan?
ControlScan crashes our server as well (even on the 'slow' setting). This is doubly annoying since, on the slow setting, the scan takes almost four days so when the server crashes...the scan fails and we have to start all over. Our application might not be the most efficient ever, but this is on a relatively new, dedicated server that has no problems with any other traffic.
We've brought the matter to ControlScan's attention but they don't seem interested in fixing it by adding a slower scan speed option. Most of their requests during the scan process seem relatively well paced, but there appears to be one particular section of their logic (blind SQL injection or XSS probing I think) that runs too fast (we've logged almost 100 requests a second from them during this piece). They really, really need to work on their code...and maybe add a 'very slow' setting. Their solution was to offer to sell us some sort of hosted firewall product / solution (I can't remember how much it cost a month)...we weren't interested.
You could add an explicit DROP at the beginning of INPUT table
iptables -I INPUT 1 -s ip.add.re.ss -j DROP
This will drop all existing connections from ip.add.re.ss and not allow new ones from it either.
We use them for PCI.
They have a cancel button to stop running scans on your site. Also they have three different scan speeds.
Maybe try a slower scan.
iptables
to block the host or hosts running the scan?iptables
. If you block all packets from an address, you block those which are part of existing connections as well as new ones. It's certainly possible to craft a rule that only blocks new connections, but that's neither a requirement nor a limitation iniptables
.