From: rruegner <robert@ruegner.org>
To: Stephen J Smoogen <smoogen@lanl.gov>
Cc: Daniel Chemko <dchemko@smgtec.com>,
netfilter@lists.netfilter.org, Khanh Tran <khanh@slc.edu>
Subject: Re: virus scanning with iptables
Date: Fri, 10 Sep 2004 17:54:21 +0200 [thread overview]
Message-ID: <4141CE2D.2020506@ruegner.org> (raw)
In-Reply-To: <4141C983.5050409@lanl.gov>
Hi,
better way would be to use apache2 , mod_clamd, and squid / frox
or use dansgurdian, or some comercial Produkt
This would do the job for http/ftp...clamd also works with amavis-new
for antispam and antivirus to smtp.
Regards
Stephen J Smoogen schrieb:
> Khanh Tran wrote:
>
>> How about port scanning clients behind from the firewall? Suggestions?
>> I'm thinking of something that could be scripted to append an iptables
>> rule to block the MAC address of the offending client, then notify me.
>> Am I looking at an NMAP plugin possibly?
>>
>
> You would probably want to have something like SNORT tied into iptables.
> Have something like SNORT look for certain alerts and then when it
> finds them it sends a 'signal' to a daemon on the firewall that inserts
> a DROP rule for that IP address in a 'dynamic chain'.
>
next prev parent reply other threads:[~2004-09-10 15:54 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-09-10 0:36 virus scanning with iptables Khanh Tran
2004-09-10 15:34 ` Stephen J Smoogen
2004-09-10 15:54 ` rruegner [this message]
2004-09-10 15:50 ` Stephen J Smoogen
2004-09-10 16:37 ` Jose Maria Lopez
-- strict thread matches above, loose matches on Subject: below --
2004-09-09 23:26 Daniel Chemko
2004-09-10 7:49 ` Victor Julien
2004-09-09 23:09 Khanh Tran
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4141CE2D.2020506@ruegner.org \
--to=robert@ruegner.org \
--cc=dchemko@smgtec.com \
--cc=khanh@slc.edu \
--cc=netfilter@lists.netfilter.org \
--cc=smoogen@lanl.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.