From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 962D8C83004 for ; Wed, 29 Apr 2020 09:31:36 +0000 (UTC) Received: from shelob.surriel.com (shelob.surriel.com [96.67.55.147]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 4326E2074A for ; Wed, 29 Apr 2020 09:31:35 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4326E2074A Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=thorondir.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kernelnewbies-bounces@kernelnewbies.org Received: from localhost ([::1] helo=shelob.surriel.com) by shelob.surriel.com with esmtp (Exim 4.92.3) (envelope-from ) id 1jTj2e-0007Yn-Qj; Wed, 29 Apr 2020 05:30:08 -0400 Received: from imp.thorondir.com ([176.9.145.14]) by shelob.surriel.com with esmtp (Exim 4.92.3) (envelope-from ) id 1jTj2b-0007Yh-Jq for kernelnewbies@kernelnewbies.org; Wed, 29 Apr 2020 05:30:05 -0400 Received: from localhost (unknown [127.0.0.1]) by imp.thorondir.com (Postfix) with ESMTP id E2706145CED; Wed, 29 Apr 2020 09:30:02 +0000 (UTC) X-Virus-Scanned: amavisd-new at thorondir.com Received: from imp.thorondir.com ([127.0.0.1]) by localhost (mail.thorondir.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QUGuUaRbTS4G; Wed, 29 Apr 2020 09:30:01 +0000 (UTC) Received: from webmail.thorondir.com (imp [IPv6:2a01:4f8:160:2344::2]) by imp.thorondir.com (Postfix) with ESMTPSA id DA6A5145CE8; Wed, 29 Apr 2020 09:30:00 +0000 (UTC) MIME-Version: 1.0 Date: Wed, 29 Apr 2020 11:30:00 +0200 From: Thorondir To: noloader@gmail.com Subject: Re: iptables and combining additional rule sources In-Reply-To: References: User-Agent: Roundcube Webmail/1.4.3 Message-ID: <4f0d07797afa49e790692bde829775c8@thorondir.com> X-Sender: thorondir+kernelnewbies@thorondir.com Cc: kernelnewbies X-BeenThere: kernelnewbies@kernelnewbies.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Learn about the Linux kernel List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Errors-To: kernelnewbies-bounces@kernelnewbies.org On 2020-04-25 00:28, Jeffrey Walton wrote: > Hi Everyone, > > We are having trouble with our MediaWiki installation on a low-end VM. > The VM is servicing a lot of spam traffic, and it is driving cpu usage > up to about 80%. The 404's appear to be more expensive then the 200's. > GoDaddy wrote to us and told us they were going to suspend our service > if we don't get cpu usage down. > > I experimented with several Apache and MediaWiki plugins and I have a > design I like. The plugin scans the URL, detects the problematic URLs, > and sends the ip address to a privileged out-of-proc proxy to update > iptables. The proxy is privileged and can update iptables rules. It > also maintains a database to remove the host after 45 days. Hi Jeffrey, have you looked into Fail2Ban? It seems to do what you need, but real-time. Kind regards, Thorondir _______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies