Open Source Project, maybe

[matonb]

Some of you will be familiar with apf and bfd firewall tools from rfxnetworks.

I'd like to script something similar to bfd which would allow firewalls generated with fwbuilder to benefit from brute force attack detection.

What I'm after here is your opinions/views on setting out the criterion to select hosts to ban before I submit the project to SourceForge.

"My" primary concern for BF detection is ssh as my home box is constantly bombarded with attacks, I'm not particularly worried as it only accepts keys for login authentication, I would like to block the offending IP's automatically all the same.

And lastly, anyone else interested in participating in the project?

[RobinVossen]

Well to do something like this. There are already lots of tools/ways.
So what do you want to do that is Diffrent?
You can use PAM Modules that only allow three logins and then Block a IP..

Hope that does answer you a little

[matonb]

Well to do something like this. There are already lots of tools/ways.
So what do you want to do that is Diffrent?
You can use PAM Modules that only allow three logins and then Block a IP..

Hope that does answer you a little

Hi Robin,

I used to use bfd and apf, vrey simple and very effective. However my prefered FW tool of the moment is FW builder and I do miss the BFD element.

Many moons ago a I worte (albeit, lame) php script that would intercept the NCR worm attacking my apache servers, then go figure out who the domain belongs to, email the offending domains admin alterting them to the infection and then block the ip address.

So this little project would follow the same path, deal with the offending IP, alert the domain admin and possibly report directly to IANA.

The area "I" would deal with first is ssh as it just anoys me

There is no reason not to analyse other potential breakin attempts from various logs and take actions on those as well.

[RobinVossen]

Ah yea thats a good idea.
Reporting everything to the ISP so ScriptKiddies get what they decerive.

Well I dont have much time but I am in


Cheers,
Robin

[matonb]

Pending approval on SourceForge

[RobinVossen]

k, cool

Post the link Tomorrow. And (if you want ) you can send me a Developer - Do yopu want to join?
msg on SF.. ^^