deny cgi scanner

deny cgi scanner

[Eric Marchionni]

hi all

does anybody know how to drop packets with
destination-port 80 after a limit of connections
has been reached?
i'd like to deny access for the attacker as soon
as a cgi-scan has been detected.

is it possible to do that with iptables?

plz let me know =)
thx
eric

Re: deny cgi scanner

[Cedric Blancher]

Le mar 01/04/2003 à 19:34, Eric Marchionni a écrit :
> does anybody know how to drop packets with
> destination-port 80 after a limit of connections
> has been reached?
> i'd like to deny access for the attacker as soon
> as a cgi-scan has been detected.

See patch-o-matic iplimit match :

http://www.netfilter.org/documentation/pomlist/pom-base.html#iplimit

| Author: Gerd Knorr <kraxel@bytesex.org>
| Status: ItWorksForMe[tm]
|
| This adds CONFIG_IP_NF_MATCH_IPLIMIT match allows you to restrict the
| number of parallel TCP connections to a server per client IP address
| (or address block).
|
| Examples:
|
| # allow 2 telnet connections per client host
| iptables -p tcp --syn --dport 23 -m iplimit --iplimit-above 2 -j REJECT
|
| # you can also match the other way around:
| iptables -p tcp --syn --dport 23 -m iplimit ! --iplimit-above 2 -j ACCEPT
|
| # limit the nr of parallel http requests to 16 per class C sized
| # network (24 bit netmask)
| iptables -p tcp --syn --dport 80 -m iplimit --iplimit-above 16		\
|	--iplimit-mask 24 -j REJECT

I think it exactly fits your needs ;)

Note that someone has recently posted a patch to extend iplimit match to
UDP.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux  - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE

Re: deny cgi scanner

[Jesper Lund]

> does anybody know how to drop packets with
> destination-port 80 after a limit of connections
> has been reached?
> i'd like to deny access for the attacker as soon
> as a cgi-scan has been detected.
>
> is it possible to do that with iptables?

The patch-o-matic module iplimit can do exactly that.

//Jesper

Re: deny cgi scanner

[Eric Marchionni]

thx a lot cedric and jesper!

Cedric Blancher wrote:
> Le mar 01/04/2003 à 19:34, Eric Marchionni a écrit :
> 
>>does anybody know how to drop packets with
>>destination-port 80 after a limit of connections
>>has been reached?
>>i'd like to deny access for the attacker as soon
>>as a cgi-scan has been detected.
> 
> 
> | # limit the nr of parallel http requests to 16 per class C sized
> | # network (24 bit netmask)
> | iptables -p tcp --syn --dport 80 -m iplimit --iplimit-above 16		\
> |	--iplimit-mask 24 -j REJECT
> 
> I think it exactly fits your needs ;)

this sounds already pretty good!
as far as i understand this will result in a slowdowned scan.
if somehow possible i'd like to abort the scan at all. like
denying any connection from the attackers ip for about 1 minute 
or so...
(i know it's dangerous if someone begins spoofing google-ip or
my dns-server-ip with a cronjob, but this would only affect the
web-server...)

else i'll use iplimit ;-D

-eric

Re: deny cgi scanner

[Stephen Frost]

[-- Attachment #1: Type: text/plain, Size: 1278 bytes --]

* Eric Marchionni (mailing-lists@gmx.ch) wrote:
> as far as i understand this will result in a slowdowned scan.
> if somehow possible i'd like to abort the scan at all. like
> denying any connection from the attackers ip for about 1 minute 
> or so...
> (i know it's dangerous if someone begins spoofing google-ip or
> my dns-server-ip with a cronjob, but this would only affect the
> web-server...)
> 
> else i'll use iplimit ;-D

Use iplimit with ipt_recent and you can achieve exactly that.  Or just
use ipt_recent if you can come up with a rule to identify the attacker
w/o using iplimit.  To use ipt_recent you do:

# Bad guy in the list with activity less than 60 seconds ago..
iptables -A FORWARD -m recent --rcheck --seconds 60 --name badguy -j DROP 

# Check for bad guy, go to BADCHAIN if found..
iptables -A FORWARD -m limit --etcetc -j BADCHAIN 

# Bad guy detected!  Add his IP to the badguy list!
iptables -A BADCHAIN -m recent --set --name badguy -j DROP # Add IP to list

The ipt_recent module homepage is
http://snowman.net/projects/ipt_recent/

A pretty recent version (0.3.0) is also in netfilter CVS.  ipt_recent
0.3.1 is out and I expect it will be in netfilter CVS soon.  The primary
fix in 0.3.1 is TTL handling.

	Stephen

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: deny cgi scanner

[Arnt Karlsen]

On Tue, 1 Apr 2003 15:06:52 -0500, 
Stephen Frost <sfrost@snowman.net> wrote in message 
<20030401200652.GY18434@ns.snowman.net>:

> 
> # Bad guy detected!  Add his IP to the badguy list!
> iptables -A BADCHAIN -m recent --set --name badguy -j DROP # Add IP to
> list

..this also shoots down the good guys with servers on dynamic dns, 
using an old recycled-by-the-isp bad guy's ip.

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

Re: deny cgi scanner

[Stephen Frost]

[-- Attachment #1: Type: text/plain, Size: 1477 bytes --]

* Arnt Karlsen (arnt@c2i.net) wrote:
> On Tue, 1 Apr 2003 15:06:52 -0500, 
> Stephen Frost <sfrost@snowman.net> wrote in message 
> <20030401200652.GY18434@ns.snowman.net>:
> > # Bad guy detected!  Add his IP to the badguy list!
> > iptables -A BADCHAIN -m recent --set --name badguy -j DROP # Add IP to
> > list
> 
> ..this also shoots down the good guys with servers on dynamic dns, 
> using an old recycled-by-the-isp bad guy's ip.

That's why there's a time limit to it.  Chances are pretty bad you're
going to have a good guy getting the bad guy's ip within 60 seconds and
worse that they're both going to try and go to the given site.
Additionally, there's an option to require a TTL match for those who are
really concerned about it to make it even less likely to be an issue
(and for cases where the bad guy likes to spoof his IP's, though do
realize that if the bad guy spoof's google's IP address it's not a big
deal because we use this state-based firewalling thing and the recent
module should be used to filter inbound NEW packets, not ones already
set up, so outbound connections to google wouldn't be affected).

And, of course, you can always also create 'whitelists' in addition to
the 'blacklists' in situations where you have friends who like to mess
with other friends (my friends are great sometimes..; of course, it's my
fault for making them listen to me babble on about my wonderful
ipt_recent kernel module ;) ).

	Stephen

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: deny cgi scanner

[Arnt Karlsen]

On Wed, 2 Apr 2003 07:54:01 -0500, 
Stephen Frost <sfrost@snowman.net> wrote in message 
<20030402125401.GC18434@ns.snowman.net>:

> * Arnt Karlsen (arnt@c2i.net) wrote:
> > On Tue, 1 Apr 2003 15:06:52 -0500, 
> > Stephen Frost <sfrost@snowman.net> wrote in message 
> > <20030401200652.GY18434@ns.snowman.net>:
> > > # Bad guy detected!  Add his IP to the badguy list!
> > > iptables -A BADCHAIN -m recent --set --name badguy -j DROP # Add
> > > IP to list
> > 
> > ..this also shoots down the good guys with servers on dynamic dns, 
> > using an old recycled-by-the-isp bad guy's ip.
> 
> That's why there's a time limit to it.  

..ah, "-m recent", missed that one.  ;-)

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.