Re: denyhosts-like app for MySQLd?

On Mon, 21 Jan 2008, Jordi Espasa Clofent wrote:
There is a functionality in pf, that allows you to have an application to
update a list of hosts, that is used in a rule. You could have a script
harvest the addresses from your log files, and then update the table in pf. I
have not tried it myself, but was looking at adopting an implementation to
create a tarpit for spammers based on this idea.

Yes Tim, I know it. The "problem" is the servers are builded in IPFW as
firewall solution.
I've tried the "limit" IPFW's option... but isn't exactly what I'm
looking for.

No problem; IPFW has tables too, and sets, with which you could
enable/disable or swap your script-constructed tables atomically.

Might be easier to allow good hosts rather than exclude baddies?

cheers, Ian

_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Using sysctl(1) to gather resource consumption data
    ... A given child process copies over a shell script to the remote machine, ... it first checks the file that lists the hosts ... me that this might be a good time to add some more sysctlOIDs. ...
    (freebsd-performance)
  • Using sysctl(1) to gather resource consumption data
    ... So I cobbled up a Perl script to run on a data-gathering machine (that ... A given child process copies over a shell script to the remote machine, ... it first checks the file that lists the hosts ... me that this might be a good time to add some more sysctlOIDs. ...
    (freebsd-performance)
  • Re: RFC: my firewall ruleset(s)
    ... IPFW numbers rules that increment by 1. ... > The reasoning behind this is so I have a single firewall script for all ... Depending on the rc.conf entries on that server, the firewall ...
    (freebsd-questions)
  • Re: Massive ssh login attempts
    ... if you go with ipfw then i've written a script as well that "shitlists" these ... and FTP failed logins and blocks them. ... for BASTARD in $BASTARDS; do ...
    (comp.unix.bsd.freebsd.misc)
  • Re: security through obscurity (was: Re: remove apache os banner
    ... But Jay was criticizing the utility of banner munging with or without those ... for most of the hosts out there. ... You code a script, or rather find one, that simply tries to connect to the ... Your exploit works with just apache and that too a particular ...
    (Security-Basics)