Toby Bluhm wrote:
>
> Try fail2ban from rpmforge.
The main problem with fail2ban is that it's based on Python, so it takes
a fair bit of memory. This isn't a big problem on a dedicated server or
on a system with swap, but a lot of these attacks are made against
shared servers or those running virtual machine schemes like OpenVZ,
which don't allow swap, so you don't have enough memory to run something
so heavy.
What I do on my VPS is periodically look at the logs and ban attackers
by hand with this script, which I call iptdrop:
DROPFILE=/etc/network/iptables-drops
if [ -n "$1" ] ; then
iptables -I INPUT -s "$1" -j DROP
echo $1 >> $DROPFILE
else
echo usage: $0 ipaddress
echo
exit 1
fi
Then in /etc/rc.local:
while read ip ; do
iptables -I INPUT -s "$ip" -j DROP
done < /etc/network/iptables-drops
That restores any bans on reboot.
After a week or three, I remove the IP from the list, on the theory that
it might be some bot-infested PC behind DHCP, and so has probably moved on.
_______________________________________________
CentOS mailing list
CentOS@centos.org
http://lists.centos.org/mailman/listinfo/centos
