Re: Centos VPS Kernel 2.6.35.4 & 'string-less' IP tables

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



Always Learning wrote:
>
> On Wed, 2011-08-31 at 11:16 -0400, m.roth@xxxxxxxxx wrote:
>
>> Maybe not, for a small website. However, let me re-suggest fail2ban,
>> with
>> three lines from one of our config files:
>> failregex = <HOST> -.*"GET
>> .*(php|pma|PMA|p/m/a|db|sql|admin).*/(config/c
>>       onfig\.inc|main)\.php.*".*404.*
>>          ^<HOST> -.*"GET .*(phpmyadmin).*\.php.*".*404.*
>>          ^<HOST> -.*"GET /w00tw00t\.at
>
> Looking at your example seems to suggest Fail2Ban is an 'after the
> event' response. I would like to implement 'before the event' filtering
> which prevents, even on the first detected hacking attempt, anything
> reaching HTTPD.

It is an after the event: after 3? 5? (I forget the default, but that can
be configured), it adds a rule to iptables to ban that IP for a limited
time. That, too, can be changed; I haven't done it, but I'd be surprised
if you can't configure it to ban that IP permanently.

        mark

_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos


[Index of Archives]     [CentOS]     [CentOS Announce]     [CentOS Development]     [CentOS ARM Devel]     [CentOS Docs]     [CentOS Virtualization]     [Carrier Grade Linux]     [Linux Media]     [Asterisk]     [DCCP]     [Netdev]     [Xorg]     [Linux USB]
  Powered by Linux