Re: [gentoo-user] Re: help! IP blocking not working

[Grant]

>>> Hi, my site is being ravaged by an IP but dropping the IP via
>>> shorewall is seeming to have no effect.  I'm using his IP from nginx
>>> logs.  IP blocking in shorewall has always worked before.  What could
>>> be happening?
>>
>>
>> I'm blocking like this with the firewall running on the web server:
>>
>> /etc/shorewall/rules
>> DROP    net:1.2.3.4      $FW
>>
>> Could shorewall/iptables see a different IP address than the one seen by nginx?
>
>
> Most likely the file is configured but the firewall service wasn't
> restarted or the rules no loaded.


I restarted shorewall plenty.  :)  I believe the issue was either a
persistent connection which conntrack-tools would have allowed me to
flush, or my blocking in /etc/shorewall/rules instead of
/etc/shorewall/blrules, or both.


> But as Jeremi pointed out. failsban is a far superior tool for this.
> Ossec with it's active response is also good.
> There are quite a few more tools in this space, and they all work much
> the same way - scan logs looking for dodgy stuff going on the
> dynamically apply a packet filter rule. The software also does it all
> day every day, and that's a record you the human cannot hope to match :-)


I'm happy to say fail2ban is running now:

# fail2ban-client status
Status
|- Number of jail: 10
`- Jail list: nginx-botsearch, nginx-http-auth, nginx-limit-req,
pam-generic, php-url-fopen, postfix, postfix-rbl, postfix-sasl, sshd,
sshd-ddos

I should probably play with the config a bit.  I'm pretty much using
defaults.  For example I think the sshd hackers make their attempts
really slowly but it would be nice to ban them anyway:

# fail2ban-client status sshd
Status for the jail: sshd
|- Filter
|  |- Currently failed: 2
|  |- Total failed: 58
|  `- File list: /var/log/sshd/current
`- Actions
   |- Currently banned: 0
   |- Total banned: 3
   `- Banned IP list:

Also I wish fail2ban-client would display a tally of all fails and
bans with a single command.

- Grant