Subj : Blocked IP's
To : Daryl Stout
From : mark lewis
Date : Tue Jul 07 2015 11:20 am
06 Jul 15 11:07, you wrote to MATT BEDYNEK:
MB>> It is like fishing. Cast a line in the water and eventually you get
MB>> a bite. For these dictionaries are used to crack passwords. The only
MB>> guessing is in username. Believe it or not these work quite well
MB>> when the work is distribu among hundreds of compromised zombie hosts.
MB>> If you can change your pop ser port it is recommended to close that
MB>> hole entirely.
DS> With VADV32, I've blocked all email IP's, except the incoming ones
DS> from my email server. If they repeatedly try to crash the deal here,
DS> it ends up in the cached IP file (which then refuses the connection
DS> entirely), or I'll put it in the blocked IP address...same result.
the thing i never liked about doing that is that it leaves the server to deal
with the rejections instead of serving answers to requests... one can be DDoSed
by simply having rafts and rats of blocked IPs hitting all at once for a
sustained period... i prefer a dedicated protection system for that purpose...
then there's the thing about dynamic IPs being in the block lists... most of
those are from compromised machines that get cleaned up and/or get a new IP...
when that happens, the old blocked IP is taking up room and shouldn't be in the
list any more since it is no longer dangerous...
the system i use blocks only known attacks and for a limited random time limit
after which the IP is removed from the block list... as long as the attacking
IP tries to connect, the blocking limit is extended... the only way out is for
them to move on to another system and let the blocking period elapse... that
allows them to connect normally again and if they start another attack, they
are blocked again... the system works very well and i do not end up with
thousands of blocked IPs to try to manage manually... my blocking system is
currently managing an average of 300 blocked IPs instead of thousands upon
thousands... since it is also automated, i'm not burdened with having to
maintain the lists of IPs... i tried that one time before implementing my
current system and found myself spending 10 - 12 hours a day doing nothing but
IP management and not getting anything else done at all...
)\/(ark
... We all know you're a masticator.
---
* Origin: (1:3634/12.73)
