Is IPtables not working??BruteForce on 80

aq_mishu · 02-21-2009, 07:46 AM

great... and how to be invisible in nmap??

And the firewall is now ok with dns... so i dont need to remove anything from the chains right?? all i will do later is add... well, i will add in

iptables -A BADIPS -s A.B.C.D -j DROP

And no need if
#insert new chain into INPUT
iptables -I INPUT 2 -j BADIPS

Right?
Above all, Thank you very much Sir... for your kind patience in solving the problem. I can see the guy is trying to get access but the connection goes to sleep.... Thanks...

JulianTosh · 02-21-2009, 07:58 AM

as long as you have ports open, you'll never be completely invisible to nmap.

yes, append to the end of BADIPS chain to block other IPs and leave INPUT alone unless you need to open up more ports.

no problem, glad I could help. dont forget to click the thumbs up icon!

Yes, I'm a stat whore.

78^D

aq_mishu · 02-21-2009, 08:14 AM

a few days ago, i made a check to a server for open ports. that server was hosting dns/www/mail or all (i'm sure) but nmap gave nothing. I liked that... i could not find out any open port... but dafinitely a port is listening there....

JulianTosh · 02-21-2009, 08:21 AM

there are different ways to run nmap, some are more sneaky or ignorant than the other. For instance, some scans dont do a port scan if the host doesnt respond to icmp first. 'man nmap' to see every type of host discovery and scan techniques that are available. it's a large list.

unixfool · 02-21-2009, 09:40 AM

IMO, his SSH port could've stayed on port 30. While this is considered security by obscurity, using more than that one method alone is the better approach. And even if he has SSH key authentication enabled and the service listening on port 22, he's still going to have HUGE logs documenting all the brute forcing. He could've kept the service on port 30, enabled SSH key auth and had less of an issue with brute force AND less logs to deal with, even if all log entries are denials.

aq_mishu · 02-21-2009, 01:43 PM

Quote:

Originally Posted by unixfool

IMO, his SSH port could've stayed on port 30. While this is considered security by obscurity, using more than that one method alone is the better approach. And even if he has SSH key authentication enabled and the service listening on port 22, he's still going to have HUGE logs documenting all the brute forcing. He could've kept the service on port 30, enabled SSH key auth and had less of an issue with brute force AND less logs to deal with, even if all log entries are denials.

Liked this approach...