1

I am running a series of web servers and already have a pretty good set of firewall rules set up, however I'm looking for something to monitor the traffic and add rules as needed. I have denyhosts monitoring for bad SSH logins, and that's great - but I'd love something I could apply to the whole machine that would help prevent bute force attacks against my web applications as well, and add rules to block IPs that display evidence of common attacks.

I've seen APF, but it looks as though it hasn't been updated in several years. Is it still in use and would it be good for this? Also, what other solutions are out there that would manipulate iptables to behave in some adaptive fashion?

I'm running Ubuntu Linux, if that helps.

4 Answers 4

1

I'm a really big fan of fail2ban

http://www.fail2ban.org/wiki/index.php/Main_Page

Here is a list of the main features available in Fail2ban.

Client/Server architecture.
Multi-threaded.
Highly configurable.
FAM/Gamin support.
Parses log files and looks for given patterns.
Executes commands when a pattern has been detected for the same IP address for more than X times. X can be changed.
After a given amount of time, executes another command in order to unban the IP address.
Uses Netfilter/Iptables by default but can also use TCP Wrapper (/etc/hosts.deny) and many other actions.
Handles log files rotation.
Can handle more than one service (sshd, apache, vsftpd, etc).
Resolves DNS hostname to IP address. 
1

Learn about ipset, from the makers of iptables.

Then, learn how to use the -j SET target; preferably in combination with -m recent -m limit and/or -m hashlimit.

Good luck, young Jedi! :-)

(Since you're using Ubuntu, you must install ipset from source; see my blog for the HOWTO: http://pepoluan.posterous.com/powertip-howto-install-ipset-on-ubuntu )

1
  • In 12.04LTS, ipset is in the universe repository. sudo apt-get install ipset.
    – mivk
    Nov 16, 2013 at 13:00
0

csf should work well - FREE and well maintained.

0

It a little bit overkill but there are great project called OSSEC, it can monitor server logs and if it sees something fishy (it has list of rules plus you can write your own) it can block remote IP.

You can not call it iptables daemon, but it is way more powerful then denyhost.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .