Re: Recommendations on intrusion prevention/detection?

Wed, 22 Apr 2020 15:57:13 -0700

Iptables or ipfw you always can create tables / chains and feed those with desirable IP's to ban.

Something like fail2ban does. Make a big list, remove one or other IP.

On my setup, I got all IP's from all services and concatenate them for an local ban as fallback... (From Apache logs, from email logs, from API logs, etc...)

Snort and similar services, sometimes while are updating they list, get down the analysis allowing this way an attacker bypass while updating...

Keep an shared list blocking locally as 2nd layer firewall help on those situations.

For the list, make your choice, an open API... Some txt's, etc... Crontab running every X minutes and you would be fine.

About airport's and similar situations, if you are an corporate Enterprise, usually your employee's have an data plan from same ISP, so on this situation Enterprise usually do an quota for those and there's no need about use open WiFi.

There's no bullet silver, everyone need see what's work in your particular scenario.



Regards,




Alexandre Fernandes Pedrosa


-------
Visite: https://alexandrepedrosa.com


PGP Key: https://alexandrepedrosa.com/keys/0xE830E3336A873BE6.asc

Fingerprint: 4D63 0DEC FDA4 A8D3 DF75  94DB E830 E333 6A87 3BE6 


Esta mensagem incluindo seus anexos tem caráter confidencial e seu conteúdo restrito ao destinatário da mensagem. Se você recebeu esta mensagem por engano, queira por favor retornar o e-mail e apagá-la de seus arquivos.

Qualquer uso não autorizado ou disseminação desta mensagem ou parte dela é expressamente proibido.


Note: "The contents of this e-mail are confidential and may be privileged.

This e-mail is intended for the exclusive use of the addressee(s) state under.

If you are not the intended addressee, please contact us immediately and delete this message from your computer, you should not copy this e-mail or disclose its contents to any other person."

Em 22 de abr de 2020 19:02, Michael Peddemors <mich...@linuxmagic.com> escreveu:

On 2020-04-22 2:52 p.m., byal...@yahoo.com.br wrote:
> Usually I use pfsense as main firewall with snort blocking all kind of
> scans and others.
>
> Fail2ban triggering after 3 unsuccessful tries and for last iptables if
> Linux or ipfw If Freebsd
>
> Keep pfsense synced with intrusion lists is an must have.
>
> And for last, bans are not temporary on my setup, are forever, except if
> an real user after validate his info / data calls to unblock him.
>
> There's some guides around about deal with post screen, but never get
> that working... RBL and spamhaus lists on mail server and on DNS are
> another must have.
>
> Good luck
>
> Atenciosamente,

Just one comment.. permanent iptables bans on SSL/TLS authentication
ports is no longer a viable option, eg.. you would not want to block the
airports's IP, just because one person had an infection on his laptop..

Carrier Grade NAT, WIFI hotspots etc all would be affected.

Long term, move towards 2FA, short term block specific user auth/IP
combinations, but that won't happen in iptables.. Our case it is
proprietary methods, but using a memcache entry is a highly scalable way
to record suspicious login attempts with enough information so that you
only block the attacker, and not the IP for varying lengths of time.

Or as mentioned, temp blocking with fail2ban is an option that is
workable and easy for most people.



--
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.


Reply via email to