| 1 |
On December 3, 2008, Steve wrote: |
| 2 |
> Dmitry S. Makovey wrote: |
| 3 |
> >> Erm - surely I either need to set up my client to port-knock... which |
| 4 |
> >> is a faff I'd rather avoid... in order to use the technique. |
| 5 |
> > |
| 6 |
> > nope. just start connection. wait a minute. cancel. start another one. |
| 7 |
> > wait a minute. cancel. start new one - voila! :) |
| 8 |
> |
| 9 |
> Eeew... especially as this would apply to all connections - even the |
| 10 |
> ones where I have a DSA key. I might be able to cope with this if it |
| 11 |
> only applied to my initial connection, from which I could grab a copy of |
| 12 |
> the DSA key. |
| 13 |
|
| 14 |
Ok, let's theoreticise some more. My paranoia feels particularly frisky today, |
| 15 |
so here it is: |
| 16 |
remember, I've mentioned origianlly that once you authenticate successfully |
| 17 |
once with DSA key - your IP is whitelisted. So subsequent connections go |
| 18 |
right through. |
| 19 |
|
| 20 |
> > well. Nobody but you knows your requiremens and specifics - we're just |
| 21 |
> > listing options. It's up to you to either take 'em or leave 'em ;) |
| 22 |
> |
| 23 |
> Fair enough - but I've still not found an option for sharing/using |
| 24 |
> shared block lists for bot-nets. |
| 25 |
|
| 26 |
Open a Wiki page on Wikipedia, update it every so often and provide simple |
| 27 |
parser for it so others can recycle same IPs. Since it's a Wiki page - others |
| 28 |
can update it as well (including botnet owners, but then they'd have to |
| 29 |
reveal themselves - tricky situation) :) |
| 30 |
|
| 31 |
P.S. |
| 32 |
I think I'd better stop with my mad science projects here before I go too far |
| 33 |
and invent brand new theory on host protection ;) |
| 34 |
|
| 35 |
-- |
| 36 |
Dmitry Makovey |
| 37 |
Web Systems Administrator |
| 38 |
Athabasca University |
| 39 |
(780) 675-6245 |
Archives