Sharing hosts.deny

tkmsr · 10-22-2010, 01:15 AM

I wanted to know if there is any place where people have shared these IPs which needs to be blocked I feel most of the time the entries must be common though not always.So if hosts.deny file is shared some where then give a link.(I do use auth.log to block)

prayag_pjs · 10-22-2010, 01:18 AM

Hi,

Which IP's you are taking about?

You want to block some spam IP's?

tkmsr · 10-22-2010, 01:37 AM

No I want to block ssh originating from China,Korea,Taiwan and such part of world
in /etc/hosts.deny.
Most of the Dictionary attacks on my server are from those parts of the world.

prayag_pjs · 10-22-2010, 01:43 AM

There may be so many.Ho will you track for new ones every day?
Better implicitly deny all and allow only trusted ip's/user's
Better use iptables firewall to do this!

tkmsr · 10-22-2010, 01:47 AM

That is what I want to know I want to block the IPs which belong to China,Korea or Taiwan is there such a list which gives information which IPs are from these countries.
I will block those countries IPTABLE or hosts.deny what ever.

prayag_pjs · 10-22-2010, 01:51 AM

Hi,

Try this links

http://www.countryipblocks.net/count...s=Submit+Query

http://www.linuxquestions.org/questi...-taiwan-360119

http://www.parkansky.com/china.htm

win32sux · 10-22-2010, 07:13 AM

Quote:

Originally Posted by tkmsr

That is what I want to know I want to block the IPs which belong to China,Korea or Taiwan is there such a list which gives information which IPs are from these countries.
I will block those countries IPTABLE or hosts.deny what ever.

There's an example of how to do this right here on LQ.

tkmsr · 10-22-2010, 07:25 AM

Thats cool.

DJCharlie · 10-22-2010, 10:25 AM

You know, I've been thinking about this for a while now. We have several places online for reporting spam (SpamHaus, etc), so why not a place to report incoming ssh/ftp attacks?

Quote:

Originally Posted by tkmsr

I wanted to know if there is any place where people have shared these IPs which needs to be blocked I feel most of the time the entries must be common though not always.So if hosts.deny file is shared some where then give a link.(I do use auth.log to block)

djsmiley2k · 10-22-2010, 11:05 AM

Quote:

Originally Posted by DJCharlie

You know, I've been thinking about this for a while now. We have several places online for reporting spam (SpamHaus, etc), so why not a place to report incoming ssh/ftp attacks?

I think DShield does this, as part of SANS

tkmsr · 10-22-2010, 11:42 AM

That was helpful.