deny cgi scanner
hi all
does anybody know how to drop packets with
destination-port 80 after a limit of connections
has been reached?
i'd like to deny access for the attacker as soon
as a cgi-scan has been detected.
is it possible to do that with iptables?
plz let me know =)
thx
eric
Quoted 5 lines · Eric Marchionni
does anybody know how to drop packets with
destination-port 80 after a limit of connections
has been reached?
i'd like to deny access for the attacker as soon
as a cgi-scan has been detected.
See patch-o-matic iplimit match :
http://www.netfilter.org/documentation/pomlist/pom-base.html#iplimit
| Author: Gerd Knorr <[email protected]> | Status: ItWorksForMe[tm] | | This adds CONFIG_IP_NF_MATCH_IPLIMIT match allows you to restrict the | number of parallel TCP connections to a server per client IP address | (or address block). | | Examples: | | # allow 2 telnet connections per client host | iptables -p tcp --syn --dport 23 -m iplimit --iplimit-above 2 -j REJECT | | # you can also match the other way around: | iptables -p tcp --syn --dport 23 -m iplimit ! --iplimit-above 2 -j ACCEPT | | # limit the nr of parallel http requests to 16 per class C sized | # network (24 bit netmask) | iptables -p tcp --syn --dport 80 -m iplimit --iplimit-above 16 \ | --iplimit-mask 24 -j REJECT
I think it exactly fits your needs ;)
Note that someone has recently posted a patch to extend iplimit match to UDP.
Signature · 4 lines
Cédric Blancher <[email protected]> Consultant en sécurité des systèmes et réseaux - Cartel Sécurité Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99 PGP KeyID:157E98EE FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE
thx a lot cedric and jesper!
Quoted 9 lines · Cedric Blancher
Quoted 5 lines · Eric Marchionni
does anybody know how to drop packets with
destination-port 80 after a limit of connections
has been reached?
i'd like to deny access for the attacker as soon
as a cgi-scan has been detected.
Quoted 6 lines
| # limit the nr of parallel http requests to 16 per class C sized | # network (24 bit netmask) | iptables -p tcp --syn --dport 80 -m iplimit --iplimit-above 16 \ | --iplimit-mask 24 -j REJECTI think it exactly fits your needs ;)
this sounds already pretty good!
as far as i understand this will result in a slowdowned scan. if somehow possible i'd like to abort the scan at all. like denying any connection from the attackers ip for about 1 minute or so... (i know it's dangerous if someone begins spoofing google-ip or my dns-server-ip with a cronjob, but this would only affect the web-server...)
else i'll use iplimit ;-D
-eric
Quoted 9 lines · * Eric Marchionni ([email protected]) wrote:
as far as i understand this will result in a slowdowned scan. if somehow possible i'd like to abort the scan at all. like denying any connection from the attackers ip for about 1 minute or so...
(i know it's dangerous if someone begins spoofing google-ip or my dns-server-ip with a cronjob, but this would only affect the web-server...)else i'll use iplimit ;-D
Use iplimit with ipt_recent and you can achieve exactly that. Or just use ipt_recent if you can come up with a rule to identify the attacker w/o using iplimit. To use ipt_recent you do:
# Bad guy in the list with activity less than 60 seconds ago.. iptables -A FORWARD -m recent --rcheck --seconds 60 --name badguy -j DROP
# Check for bad guy, go to BADCHAIN if found..
iptables -A FORWARD -m limit --etcetc -j BADCHAIN
# Bad guy detected! Add his IP to the badguy list!
iptables -A BADCHAIN -m recent --set --name badguy -j DROP # Add IP to list
The ipt_recent module homepage is
http://snowman.net/projects/ipt_recent/
A pretty recent version (0.3.0) is also in netfilter CVS. ipt_recent 0.3.1 is out and I expect it will be in netfilter CVS soon. The primary fix in 0.3.1 is TTL handling.
Stephen
On Tue, 1 Apr 2003 15:06:52 -0500,
Stephen Frost <[email protected]> wrote in message <[email protected]>:
Quoted 4 lines
# Bad guy detected! Add his IP to the badguy list! iptables -A BADCHAIN -m recent --set --name badguy -j DROP # Add IP to list
..this also shoots down the good guys with servers on dynamic dns, using an old recycled-by-the-isp bad guy's ip.
Signature · 4 lines
..med vennlig hilsen = with Kind Regards from Arnt... ;-) ...with a number of polar bear hunters in his ancestry... Scenarios always come in sets of three: best case, worst case, and just in case.
Quoted 9 lines · * Arnt Karlsen ([email protected]) wrote:
On Tue, 1 Apr 2003 15:06:52 -0500,
Stephen Frost <[email protected]> wrote in message <[email protected]>:Quoted 3 lines
# Bad guy detected! Add his IP to the badguy list! iptables -A BADCHAIN -m recent --set --name badguy -j DROP # Add IP to list
..this also shoots down the good guys with servers on dynamic dns, using an old recycled-by-the-isp bad guy's ip.
That's why there's a time limit to it. Chances are pretty bad you're going to have a good guy getting the bad guy's ip within 60 seconds and worse that they're both going to try and go to the given site. Additionally, there's an option to require a TTL match for those who are really concerned about it to make it even less likely to be an issue (and for cases where the bad guy likes to spoof his IP's, though do realize that if the bad guy spoof's google's IP address it's not a big deal because we use this state-based firewalling thing and the recent module should be used to filter inbound NEW packets, not ones already set up, so outbound connections to google wouldn't be affected).
And, of course, you can always also create 'whitelists' in addition to the 'blacklists' in situations where you have friends who like to mess with other friends (my friends are great sometimes..; of course, it's my fault for making them listen to me babble on about my wonderful ipt_recent kernel module ;) ).
Stephen
On Wed, 2 Apr 2003 07:54:01 -0500,
Stephen Frost <[email protected]> wrote in message <[email protected]>:
Quoted 12 lines · * Arnt Karlsen ([email protected]) wrote:
Quoted 9 lines
On Tue, 1 Apr 2003 15:06:52 -0500,
Stephen Frost <[email protected]> wrote in message <[email protected]>:Quoted 3 lines
# Bad guy detected! Add his IP to the badguy list! iptables -A BADCHAIN -m recent --set --name badguy -j DROP # Add IP to list
..this also shoots down the good guys with servers on dynamic dns, using an old recycled-by-the-isp bad guy's ip.
That's why there's a time limit to it.
..ah, "-m recent", missed that one. ;-)
Signature · 4 lines
..med vennlig hilsen = with Kind Regards from Arnt... ;-) ...with a number of polar bear hunters in his ancestry... Scenarios always come in sets of three: best case, worst case, and just in case.
Quoted 7 lines
does anybody know how to drop packets with
destination-port 80 after a limit of connections
has been reached?
i'd like to deny access for the attacker as soon
as a cgi-scan has been detected.is it possible to do that with iptables?
The patch-o-matic module iplimit can do exactly that.
//Jesper