Re: IPtables rules to block by symbolic host name, not IP ?

From: Chris Lowth (please@no.spam)
Date: 04/22/03 

From: Chris Lowth <please@no.spam>
Date: Tue, 22 Apr 2003 15:13:05 +0100

Kasper Dupont wrote:

> Somebody wrote:
>>
>> The following lines kill off the various windows attacks that I know of:
>> iptables -A INPUT -m string --string 'default.ida' -p tcp --dport 80 -j
>> DROP iptables -A INPUT -m string --string 'winnt' -p tcp --dport 80 -j
>> DROP iptables -A INPUT -m string --string 'root.exe' -p tcp --dport 80 -j
>> DROP iptables -A INPUT -m string --string 'vti_inf' -p tcp --dport 80 -j
>> DROP
>
> Sounds like a very bad piece of advice. The TCP connections has been
> established, you are going to get quite some retries and stalling
> connections. And you might as well have false positives if the strings
> are eventually used in legitimate requests. Using
> "-j REJECT --reject-with tcp-reset" might be a better choice, but I
> guess you are only breaking the connection on the client side. The
> server will probably still have a stalled connection.
>

Since these attacks are Windows/IIS related ones and you are using a Linux
server (I assume: apache), why not positively ALLOW the attacks - and
provide CGI scripts called "default.ida", "root.exe" and so on, and arrange
for them to set up an iptables rule to block the address on the fly (block
the SYN only, so that the current connection can terminate quietly).

Or: script a parse of the log files (that's what I do). A few lines of perl
can be used to build iptables rules to block IPs that consistantly access
certain URLs.

Alternatively - consider that these attacks cant harm you and simply ignore
them (you can even tell apache not to log such URLs).

Chris 

-- 
My real address is: chris at lowth dot sea oh em
-> OpenSource e-mail virus protection : http://protector.sourceforge.net
-> iptables configuration wizards : http://www.lowth.com/LinWiz

Relevant Pages

  • RE: Sessions Resource Exhaustion
    ... These attacks are called DDOS attacks as they can originate from single ... the security device based on kind of traffic expected in the network. ... TCP Connection floods: TCP connection is the one where three-way TCP ...
    (Focus-IDS)
  • [Full-disclosure] ICMP-based blind connection-reset attack
    ... Here's the packet trace and the explanation of an ICMP-based blind ... In our sample scenario, a web-client (10.0.0.1, TCP port 3270) is ... This simple command would reset the connection. ... All these attacks are *blind*. ...
    (Full-Disclosure)
  • ICMP-based blind connection-reset attack
    ... Here's the packet trace and the explanation of an ICMP-based blind ... In our sample scenario, a web-client (10.0.0.1, TCP port 3270) is ... This simple command would reset the connection. ... All these attacks are *blind*. ...
    (Bugtraq)
  • ICMP-based blind connection-reset attack
    ... Here's the packet trace and the explanation of an ICMP-based blind ... In our sample scenario, a web-client (10.0.0.1, TCP port 3270) is ... This simple command would reset the connection. ... All these attacks are *blind*. ...
    (Security-Basics)
  • Re: Fortuna
    ... > The ISN selection is there only to make it harder to accomplish TCP ... > connection); and we also rekey every few minutes, ... collision attacks are not directly relevant. ... subpool 31 is added every 6.8 years. ...
    (Linux-Kernel)