Hardening FC3 webserver against intruders

[Bob Brennan]

I consider myself an advanced novice setting up an FC3 webserver with
http, ftp, and mail services; and try to heed the advice of all here
as far as I can with security.

I have a lot of (unsuccessful) logged attacks of dictionary-login
attempts, obviously automated and from a different dial-up IP address
most days. None are successful since I have very few users and don't
allow unsafe passwords.

My question is - is there anything I can set up to shut down the
repeated attempts from the same (different every day) IP? The obvious
choice would be to deny connections to IP address a.b.c.d after x
number of failed login attempts for y period of time, where I would
set x=3 and y=10 minutes.

Basically I'm looking for toad-proofing.
Is there such a thing and where would I look for it? 

Thanks in advance,
bob

[Rahul Sundaram]

On Thu, 3 Feb 2005 13:08:26 +0000, Bob Brennan <rbrennan96(a)gmail.com&gt; wrote:
>  I consider myself an advanced novice setting up an FC3 webserver
> with
>  http, ftp, and mail services; and try to heed the advice of all here
>  as far as I can with security.
>  
>  I have a lot of (unsuccessful) logged attacks of dictionary-login
>  attempts, obviously automated and from a different dial-up IP address
>  most days. None are successful since I have very few users and don't
>  allow unsafe passwords.
>  
>  My question is - is there anything I can set up to shut down the
>  repeated attempts from the same (different every day) IP? The obvious
>  choice would be to deny connections to IP address a.b.c.d after x
>  number of failed login attempts for y period of time, where I would
>  set x=3 and y=10 minutes.
>  
>  Basically I'm looking for toad-proofing.
>  Is there such a thing and where would I look for it?
>  
>  Thanks in advance,
>  bob 
apf - http://www.rfxnetworks.com/apf.php has something similar



-- 
Regards,
Rahul Sundaram

[Mike Klinke]

On Thursday 03 February 2005 07:08, Bob Brennan wrote:
 
>  My question is - is there anything I can set up to shut down the
>  repeated attempts from the same (different every day) IP? The
>  obvious choice would be to deny connections to IP address a.b.c.d
>  after x number of failed login attempts for y period of time,
>  where I would set x=3 and y=10 minutes.
>
>  Basically I'm looking for toad-proofing.
>  Is there such a thing and where would I look for it?
>
>  Thanks in advance,
>  bob 
You might want to take a look at "snort": www.snort.org.  It's an 
intrusion detection system that has the ability to reject/drop 
connections based on packet rules.  Two features named FLEXRESP and 
INLINE may help you.

If you are using ftp via xinetd you can also use the SENSOR function 
to block various IP addresses if they are scanning other ports too.  
See http://www.web-insights.net/xinetd/xinetd-sensors.html for a 
description of this technique.

Regards, Mike Klinke