2

ControlScan's PCI compliance scan is running on one of the hundreds of websites that I have on my Amazon Web Services server, but is slowing or bringing down the whole server.

What suggestions do you have to block this scan?

7
  • 2
    Use iptables to block the host or hosts running the scan?
    – MadHatter
    Apr 4, 2013 at 5:54
  • It looks like iptables will allow new connections to be blocked but not existing ones. Any thoughts on how to block all connections from specific IPs? Apr 4, 2013 at 6:00
  • 5
    Stop paying them? Apr 4, 2013 at 6:01
  • 2
    Sorry, but that's simply not right about iptables. If you block all packets from an address, you block those which are part of existing connections as well as new ones. It's certainly possible to craft a rule that only blocks new connections, but that's neither a requirement nor a limitation in iptables.
    – MadHatter
    Apr 4, 2013 at 7:04
  • 2
    If a PCI compliance scan is crashing your server, figure out why and fix it. Less pleasant folks than ControlScan will be happy to crash you in the same manner.
    – ceejayoz
    Apr 4, 2013 at 14:00

3 Answers 3

3

ControlScan crashes our server as well (even on the 'slow' setting). This is doubly annoying since, on the slow setting, the scan takes almost four days so when the server crashes...the scan fails and we have to start all over. Our application might not be the most efficient ever, but this is on a relatively new, dedicated server that has no problems with any other traffic.

We've brought the matter to ControlScan's attention but they don't seem interested in fixing it by adding a slower scan speed option. Most of their requests during the scan process seem relatively well paced, but there appears to be one particular section of their logic (blind SQL injection or XSS probing I think) that runs too fast (we've logged almost 100 requests a second from them during this piece). They really, really need to work on their code...and maybe add a 'very slow' setting. Their solution was to offer to sell us some sort of hosted firewall product / solution (I can't remember how much it cost a month)...we weren't interested.

1

You could add an explicit DROP at the beginning of INPUT table

iptables -I INPUT 1 -s ip.add.re.ss -j DROP

This will drop all existing connections from ip.add.re.ss and not allow new ones from it either.

2
  • 1
    EC2 security groups don't allow you to block IPs in this manner, and blocking (in iptables or otherwise) is just going to piss off whichever of OP's clients is trying to do a vulnerability scan against their site (something that should be perfectly acceptable as a web hosting client).
    – ceejayoz
    Apr 4, 2013 at 14:44
  • 1
    @ceejayoz: Thanks - it's a while since I played with EC2 and I misremembered the security group stuff. Regarding the rest, it answers the OPs question which is how to block the scan. Whether this annoys his (supposed) customer or not wasn't (and isn't) of concern to me.
    – user9517
    Apr 4, 2013 at 14:57
0

We use them for PCI.

They have a cancel button to stop running scans on your site. Also they have three different scan speeds.

Maybe try a slower scan.

2
  • I'd guess it's not the OP's scan, but one of his clients testing their websites for vulnerabilities.
    – ceejayoz
    Apr 4, 2013 at 14:21
  • 2
    That makes sense but blocking scans via ip tables will prevent clients from ever getting compliant. Much better to educate the clients on how and when to perform scanning. I also think that if one scan brought the server down, there are stability or resource issues within the infrastructure.
    – user167841
    Apr 4, 2013 at 14:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .