Fedora Security :: Block Some Ip Address That Are Attacking Server?

Aug 26, 2009

I want to block some ip address that are attacking my server and making my ssh port busy. On searching the google, I found

Code:
iptables -A INPUT -s ip_address -j DROP

I will add this rule in iptables. My questions are:
1) do I have to do

Code:
chkconfig iptables on

so that it load the iptables at boot. I am wondering why do I need this because iptables is already modified and it loads the iptables at boot time if firewall is enabled.

2) When we add the above rule, which file is modified? Another way, where are this rules stored? It is not in /etc/sysconfig/iptables and /etc/sysconfig/iptables_config.

View 1 Replies


ADVERTISEMENT

Fedora Security :: Any Way To Block IP Address Access?

Jul 27, 2011

I recently set up a web server at home, using a non-standard port, due to my ISP blocking 80. I just checked my log files, and I see a TON of entries indicating that a file was not found "proxy-1.php", "proxyheader.php", etc. I do not have these files, not intend to have them as part of my website. I did a whois looking by IP address for several of these, and they all seem to come from an ISP in China. Is there a way to BLOCK any IP address outside the US (that is somewhat simple to do?)

View 5 Replies View Related

Security :: Block Any IP Address Who Failed To Connect More Than 3 Ssh

Mar 25, 2010

how to block any IP address who failed to connect more than 3 ssh?

View 5 Replies View Related

Ubuntu Security :: Block Device By Bluetooth Address?

Apr 22, 2010

Is it possible somehow to block some bluetooth device with specif address (mac) ?
(like iptables block by mac)?

View 3 Replies View Related

Security :: Block Computer From Connecting To A Specific IP Address?

Feb 13, 2010

I was taking a peek at the active connections shown by the Firestarter GUI and noticed the following (the source is my computer):

SourceDestinationPortServiceProgram
192.168.0.11266.235.133.4280HTTP

I closed all Internet related apps and the connection persisted. After a reboot it did not reconnect (yet).The IP address appears to belong to esomniture.com - some sort of web analytics company. How do I prevent my computer from connecting to these rascals. I have found a lot of documentation regarding stopping inbound connections to services on my computer but not the other way. I have various filtering addons installed in Firefox however, this connection seems to be at a lower level as no program is specified as being responsible for the connection.

View 8 Replies View Related

Server :: Postfix Setup To Block Spam From / To Own Address

Jun 21, 2011

I have set up a couple of postfix servers for my domains, but the only thing I am missing now is this: How to block the public sending mail from my email to my email? I have managed it with SPF, but surely there must be a better way, that returns "relay not allowed" to the client. The SPF method costs too much, since it must make a dns request for each mail. So far, I have not gotten many of these mails, unless when testing my mailserver, but as I see it, anyone should not be allowed to send mail from abuse@mydomain.com to abuse@mydomain.com.

Somebody must have thought about this a long time ago, and there is simply that little line in main.conf that I'm missing.. My setup is this (virtual): I have a primary mx, with postfix, courier IMAP/POP3 server, a user database, and sasl via saslauthd. I also have a secondary mail server (backup mx) with no sasl auth, but with a copy of the mail users in the virtual tables, but added as relay_* users instead.

Spamassassin and SPF testing is replicated too, so most of the stuff should work, but I simply cannot find a setting in Postfix that denies someone to mail FROM my address TO my address. When mailing from my address and out in the open, they are required to authenticate, but not when using one of my my domain addresses, and also targeting my domain addresses.

As said, It is possible with a strict SPF setting, but that is at a cost for every lookup. It would be quicker for postfix to lookup the sender and the recipient in the relay/virtual tables, and deny if both addresses were in the recipient tables, and sender is not authenticated.

View 5 Replies View Related

Security :: Block A Domain Name In Sendmail Server

Jul 9, 2010

I want to block a domain name in sendmail server. I added the domain name and "REJECT"in /etc/mail/access file. What has to be done for the changes to take effect? when i run make command in /etc/mail dir i get following error : make: Nothing to be done for `all'.

View 1 Replies View Related

Security :: Website Block By Using Proxy Server?

Mar 24, 2011

i am using RHEL 5. i configured proxy server. now i want block one website.

View 2 Replies View Related

Security :: Configure Server To Block Unsecured VNC Connection?

Jun 23, 2009

securing VNC connections by tunneling the connection over SSH. However, from the server perspective it will still allow an unsecured connections and you're relying on the client to setup up the SSH tunneling. Is there a way to configure the Linux server to now allow connection over an unsecured channel?

View 4 Replies View Related

Security :: Block Certain Crafted Packets With IP Tables Before Reaching A Server?

Mar 14, 2011

Battlefield 2 server being attacked by packets that creates infinite loop, then when a player disconnects, server crash.

The packets seems to be always the same.....

Attacker Script: [URL]

Script in action:

[Code].....

I need to find a way to block these 4 packets (i think theyre 4 for what i tested) with IP TABLES.

EDIT: There seem to be other different replies, maybe 1 different but no more.... maybe you can find something useful in the script.

View 3 Replies View Related

Security :: Block Particular Web Site Form Multiple Hosted Server And Allow Others?

Aug 17, 2010

I am having a web server (apache) and 3 sites are hosted in it, named as www.web1.com,www.web2.com and www.web3.com.
I need to restrict www.web2.com to Internet users and allow only to local network. At same time I need to allow www.web1.com and www.web3.com to both Internet and LAN users.

View 2 Replies View Related

Security :: Block User Accounts Who Has Not Logged In To The Server Last 2 Months?

Mar 1, 2011

We have 4 servers having rhel 5.2. We have several users logged in on one of them. We have nis server/client running on them and have common home area mounted on all of them. Now we want to disable/block the accounts of the users who have not accessed our servers in last 2 months from today.What logic should we apply to do so? We were checking stat of .bashrc of each user but is not correct logic. We are going to write shell script for the same. We dont want to do anything in users home area or their files.

View 11 Replies View Related

Security :: Configure Squid Server To Block Anon Proxy Sites?

Jul 22, 2010

I have setup a squid server on Rhel5.4. I would like to know how I can configure my squid server to block anon proxy sites.

View 3 Replies View Related

Server :: Block Email From Certain Group To A Specific Email Address?

Apr 29, 2010

Is there a way of allowing only certain domain to send e-mails to certain specific e-mail address. I am using Sendmail, and I have an alias which translate to certain members of staff within my organization. I don't expect e-mails from outside our domain to be sent to this alias e-mail address.

View 1 Replies View Related

Fedora Security :: Block One Web Page?

Mar 13, 2009

What is the easiest way to block one specifiek web page?Can I use the file /etc/deny host, or should I use another program to do this?I have already search the web andfound iptables, but that is to difficult for me, and I found squid

View 1 Replies View Related

Fedora Security :: Iptables - Block Everything From Getting In My Pc

Mar 17, 2009

What i wanted to do was block everything from getting in my pc but still be able to surf the web and still use instant messenger.

View 2 Replies View Related

Fedora Security :: Get Pam_tally2 To Block Failed Logins With Ssh?

Aug 1, 2011

I have been trying to get pam_tally2 to block failed logins with ssh. No matter how many failed logins I do I can still log in with the correct password using SSH. Anyone have this working?

Here are the configuration I am using. I have put this in sshd and password-auth-ac.

auth required pam_tally2.so deny=3 file=/var/log/tallylog lock_time=180 unlock_time=1200 magic_root account required pam_tally2.so magic_root In the /var/log/secure I do see messages related pam_tally2 and the counter going up.

View 1 Replies View Related

Security :: Blocking A Specific IP Address From Server?

May 8, 2010

I would like to COMPLETELY block a specific IP address using iptables. I found this one:

Code:

iptables -A INPUT -p tcp -s xxx.xxx.xxx.xxx -j REJECT --reject-with tcp-reset

Will this work? How do I undo the changes later?

View 2 Replies View Related

Security :: The Server Was Hacked From So Called Tor IP Address?

Nov 14, 2010

I always use professional services to secure my servers. Everything was fine for years but a week ago my server got hacked.I don't know how the hacker got my username/password - it was not something like admin, password.9 months ago my PC was infected with some virus which connected to the FTP server by using password which was saved in CuteFTP and infected all index files with some javascript. Then I changed the user/FTP password and didn't save it anymore in Cute FTP. Of course, I checked all the folders and re-uploaded all infected files. Is it possible that this virus uploaded some hidden file which was able to get the new password for this account?

The server was hacked from so called Tor IP address. I am tiref of worrying about server security and now have an idea to get a static IP address from my ISP and to allow logins only from this IP address. What do you think about it? This idea looks good for me but are there any risks to lose access to the server. Can ISP provider change the static IP address for some reason?

View 9 Replies View Related

Ubuntu Security :: Restrict Root Logons To The SSH Server To A Single Ip Address?

Feb 26, 2010

Is it possible to restrict root logons to the SSH server to just a single ip address (or maybe a range?) I have other users connecting to the server daily so restricting ALL access to a single ip i cannot do. I need root enabled (for my own reasons) but want to lock it down a bit more.

View 9 Replies View Related

Security :: Address Space Randomization On 2.6.28-15-generic Ubuntu 9.04 - Finding Base Address?

Sep 14, 2009

Im an academic (university networks and security lecturer) studying/teaching network and operating system security, and inspired by the work of Hovav Shacham set about testing ASLR on linux. Principley I did this by performing a brute force buffer overflow attack on Fedora 10 and Ubuntu 9. I did this by writting a little concurrent server daemon which accidently on purpose didnt do bounds checking.

I then wrote a client to send it a malicious string brute forcing guessed addresses which caused a return-to-libc to the function usleep with a parameter of 16m causing a delay of 16 seconds as laid out in [URL] Once I hit the delay I new I had found the function and could calculate delta_mmap allowing me to create a standard chained ret-to-libc attack. All of that works fine. However .... To complete my understanding I am trying establish where I can find the standard base address for ubuntu 9 (and other distros) for the following, taken from Shacham:-

Quote:

[code]....

/proc/uid/maps gives me some information but not the base address ldd also gives me the randomised starting address for sections in the user address space but neither gives me the base address. Intrestingly ... when a run ldd with aslr on for over (about) 100 times and checked the start point of libc I determined that the last 3 (least significant) hex digits were always 0's and the fist 4 (most significant) where between 0xB7D7 and 0xB7F9. To me this indicated that bits 22-31 were fixed and bits 12-21 were randomized with bits 11-0 fixed. Although even that doesnt define the boundaries observed correctly.

Note: I am replicating the attack to provide signatures to detect it using IDS, and for teaching purposes. I am NOT a hacker and if needed to could reply from my .ac.uk email address as verification.

View 1 Replies View Related

Fedora Security :: 'send' Address Can Be Spoofed

Oct 16, 2009

I'm behind a modem router with firewall and SElinux enabled by default - but checking my mail this morning I noticed several ' delivery failures ' ( allegedly ) from hotmail referring to mail I hadn't sent. When I checked the spam folder for the on-line side of my mail account there were more failure notices. Two points that may be relevant, one is the recent Hotmail exploit, the other is that this only occurred with the address I use for railway matters, and some people cc to everybody, so it's odds on that address is on a good few computers. On one occassion when I checked my spam folder on-line I found spam which claimed to be from myself, so I know the ' send ' address can be spoofed, is this the explanation, or is it a new kind of attack linked to the Hotmail exploit?

View 13 Replies View Related

Fedora Security :: Blocking And Allowing IP Address For FTP?

Jul 15, 2010

I want to ask about securing the FTP connection... I have one server that Installed with Redhat Linux Fedora 6.

And now, i want to securing the FTP access, so only the selected IP will be allowed to connect. Do anyone know how to do this?

Another thing is, my server using Webmin 1.3 to manage the server and there not installed / not configured yet with Frox FTP, ProFTPD Server, WU-FTP Server... even there is such thing in my Webmin...

Can i make use one of the three FTP i mention above, and if yes, will it be affecting the current FTP access?

View 1 Replies View Related

Fedora Security :: Blocking Ip Address Range?

Dec 31, 2010

I'm assuming that the following should block the complete 178.123.xxx.xxx address range.

Code:
iptables -I INPUT -s 178.123.0.0/24 -j DROP
Then I believe that I need to save this change.

Code:
service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]

However, I'm not so sure that it is actually working based on the fact that there continues to be access to my wiki from that address range. The following is after I made the firewall change.

Quote:

178.123.177.61 - - [31/Dec/2010:04:24:40 -0500] "GET /mywiki/Opera%20Web%20Browser?action=edit&editor=text HTTP/1.1" 200 6346 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
code....

Let me state that I'm new at this iptables thing. I did some reading and decided that I need to make the above change to the firewall but it doesn't seem to make a difference.

View 12 Replies View Related

General :: Block A Specific MAC Address?

Feb 5, 2011

how to block a specific MAC address

View 2 Replies View Related

General :: Block Mac Address On Squid?

May 25, 2010

how to block PC in Squid using Mac Address. I tried as in /etc/squid/squid. conf

acl block arp 00:13:45:d3: 24:e4
https_access deny block

but it give me error as like: - (This is the output of # squid -k parse) aclParseAclLine: Invalid ACL type 'arp' FATAL: Bungled squid.conf line 1234: acl block arp 00:13:45:d3: 24:e4 squid Cache (Version 2.5.STABLE6) : Terminated abnormally

View 4 Replies View Related

Ubuntu Security :: Postfix - Not Critical - SMTP Server: Errors From Unknown [ip Address] In Local Recipient Table

Jan 2, 2010

This is a transcript I get emailed at least once every day, usually about 3 to 10 a day recently.

Transcript of session follows.
SMTP server: errors from unknown[ip address]
<boring stuff snipped>
In: RCPT TO: <server@my domain>
Out: 550 5.1.1 <server@my domain>: Recipient address rejected: User unknown in local recipient table

Session aborted, reason: lost connection Now I cannot seem to find anything via Google, as when I put "server@" anywhere in the string, I just get web hosting or other kroomst. The emails usually come from legit places, usually hotels. Does this mean they are sending bad emails, i.e. they have a Trojan/worm, or is this a live hack attempt?. I believe the later, as I might get upto 3 domains from the one ip address, which is always, NOT associated with the listed domain. Not causing me any issues, except I have been getting a lot recently.

View 4 Replies View Related

Debian :: Block A Router From Giving Me A Dhcp Address

Aug 18, 2011

I get assigned an IP from the university's server. Every now and then, a student will plug in his router to the network trying to get wifi in his/her room.

And by doing so will start assigning IPs on the network, while rendering useless the university dhcp server, which has to cope with a higher number of pc's.

How can I specify to dhclient (or the linux system in general) NOT TO obtain IP addresses given by a specific mac address ?

View 7 Replies View Related

Ubuntu Networking :: Block Mac Address In Adhoc Network?

Sep 1, 2011

I want to block the Mac address in adhoc network to check the behaviour of the aodv protocol.Is there any other utility available for this purpose rather than Mackill..?

View 1 Replies View Related

General :: Block A Email Address From Logging Into Multiple Systems?

Jun 15, 2010

can we block email address in a way that a user cannot login into multiple systems simultaneously, so that if a user logs in into a system (with ip address 192.168.1.22)and if he tries to login to into another system at the same time(with ip address 10.0.0.5) his previous system(i.e 192.168.1.22) has to logout automatically. Is there any predefined scripts for this.

View 2 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved