Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.

Dismiss

Apache Security <<-- help !!

403 views

Skip to first unread message

Anonymous

unread,

Nov 29, 2000, 3:00:00 AM11/29/00

Hi all,

Recently, I've had over 200'000 hits a day .. all from people trying to
crack
the password proteced areas on my site.

I reacted by simply adding the following to my <Directory> statement:

Deny from 195 ; <- fuck 'em all!

This is a very effective way of denying _ANYONE_ from the 195 net (a VERY
insecure net!!) from accessing the web server. This requires my user
intervention to implement.

I was wondering if there is a program out there that can monitor the
error_log
file and if a user enters the wrong login/password combo more than 4 times,
it
auto-denys the user until either the end of the day, or for the next hour.

Can anybody help me out here? Or do I have to pick up my old C books and
start
coding?

-Jms

Joe Schaefer

unread,

Nov 29, 2000, 3:00:00 AM11/29/00

"Anonymous" <n...@spam.com> writes:

> Hi all,
>
> Recently, I've had over 200'000 hits a day .. all from people trying to
> crack
> the password proteced areas on my site.
>
> I reacted by simply adding the following to my <Directory> statement:
>
> Deny from 195 ; <- fuck 'em all!
>
> This is a very effective way of denying _ANYONE_ from the 195 net (a VERY
> insecure net!!) from accessing the web server. This requires my user
> intervention to implement.
>
> I was wondering if there is a program out there that can monitor the
> error_log
> file and if a user enters the wrong login/password combo more than 4 times,
> it
> auto-denys the user until either the end of the day, or for the next hour.
>

Not really - there's a chicken and egg problem here in that you don't know
who the user is until they've logged in (unless they're trying the same
known user name). If you are using basic http authentication, you are SOL
without getting into the server's API via some apache module (CGI is out.)

This is a well-known problem with http authentication, and you might find
some workarounds by searching

http://modules.apache.org.

Also there are some mod_perl packages that might be relevant, too:
look around

http://perl.apache.org

to see if there's anything that might work for you. I think you need
something like a traffic cop that's triggered by 403 responses.

HTH
--
Joe Schaefer

Anonymous

unread,

Nov 29, 2000, 3:00:00 AM11/29/00

> Not really - there's a chicken and egg problem here in that you don't know
> who the user is until they've logged in (unless they're trying the same
> known user name). If you are using basic http authentication, you are SOL
> without getting into the server's API via some apache module (CGI is out.)

I think you've misunderstood my attempt.

I want a piece of software that checks the error_log every 5 minutes for
any IP addresses that have failed to login more than x times.
With this, the software will create a flag file that has the offending
IP address(es) in it ...
In essence, once you connect, if you mis-type your login/password more
than x times, the server auto-Denys you for the next hour.
In otherwords, if you get your password wrong more than x times, the
server does not allow connections to the offending IP address(es).

> This is a well-known problem with http authentication, and you might find
> some workarounds by searching
>
> http://modules.apache.org.

I'll have a look at the modules, however, I doubt there will be a
similar module for what I require ..

Thanks for the reply,

James

Jan Novák

unread,

Nov 29, 2000, 3:00:00 AM11/29/00

What about cron with some script for reading access_log and deniig address
with ipchains ? If you have so big website u can be able to write simple
script by yourself.

Anonymous <n...@spam.com> píąe v diskusním
příspěvku:AxdV5.7436$7.23...@quark.idirect.com...

Anonymous

unread,

Nov 29, 2000, 3:00:00 AM11/29/00

"Jan Novák" <ro...@hotmail.com> wrote in message
news:903sjh$1jm2$1...@news.vol.cz...

> What about cron with some script for reading access_log and deniig address
> with ipchains?

Obviously the program will be cron driven ... but denying with ipchains
is a little overboard; besides, it will have to have timing logic enough to
release the offending IP address after a user definable time.

> If you have so big website u can be able to write simple
> script by yourself.

Just because somebody has a popular/big website doesnt mean they are a
guru. If you would have spent a little more time reading my post you would
have seen the section where I say:

"Can anybody help me out here? Or do I have to pick up my old C books and
start coding?"

-see first post

Was that not obvious enough for you?

Anyhoo ...

Joe Schaefer

unread,

Nov 29, 2000, 3:00:00 AM11/29/00

"Jan Novák" <ro...@hotmail.com> writes:

> What about cron with some script for reading access_log and deniig address

> with ipchains ? If you have so big website u can be able to write simple
> script by yourself.
>

NO. All you wind up doing is providing the offending party with a means
to DOS your entire website. When an party is attacking a website, and
the site decides to dynamically deny them access based on the reported
IP address, the following attempts will undoubtedly be addressed from
AOL's proxy servers.

These incidents need to be reported to the responsible ISP. Web servers
don't work like ftp servers, so progressively slowing your responses
down is tricky due to the sessionless nature of http.

--
Joe Schaefer

Anonymous

unread,

Nov 29, 2000, 3:00:00 AM11/29/00

You make some good points, Joe.

> NO. All you wind up doing is providing the offending party with a means
> to DOS your entire website. When an party is attacking a website, and
> the site decides to dynamically deny them access based on the reported
> IP address, the following attempts will undoubtedly be addressed from
> AOL's proxy servers.

A user who attacks a site through AOL is hard to classify as a major
threat because they are a "script kiddie" more times than none.
For the user to DOS my server, they would have to do a D.D.O.S
(distributed denial of service) to simply overflow it ...

> These incidents need to be reported to the responsible ISP. Web servers
> don't work like ftp servers, so progressively slowing your responses
> down is tricky due to the sessionless nature of http.

I ALWAYS report the miscreant children to their ISP; the problem being
that overseas ISPs turn a blind eye.
So I simply ban their entire net (as I did in the case of the 195
network)

Ideally, my program (looks like I'll start the dev/planning stage
tonight) will send an email to a specified email address with an hourly
report. The program will also log the IPs, time, etc, etc ...

Any input would be greatful ...

-James

Ian Jones

unread,

Nov 29, 2000, 3:00:00 AM11/29/00

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

"Anonymous" <n...@spam.com> wrote in message
news:8ofV5.7476$7.23...@quark.idirect.com...

I do something similar with firewall logs, except they are mailed
when a threshold of hits is achieved rather than at a specific time.
I'm sure it would be trivial to change the input source and regex to
have it apply to your problem.
http://www.speakeasy.org/~roux/dmn/firedaemon-1.0.tgz

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>
Comment: Making the world safe for geeks.

iQA/AwUBOiWVwcAVSpfzXItKEQL4dQCgi8OFloXnwBFqpV6QaYT49c5NIYIAniSp
lsVH5Z8635vpuvU5m+4QUFHO
=1Dr/
-----END PGP SIGNATURE-----

Robert Hallgren

unread,

Nov 29, 2000, 11:21:14 PM11/29/00

On Wed, 29 Nov 2000 19:34:06 GMT, Anonymous <n...@spam.com> wrote:

> Deny from 195 ; <- fuck 'em all!
>
> This is a very effective way of denying _ANYONE_ from the 195 net (a
> VERY insecure net!!) from accessing the web server.

Why would "the 195 net" be "VERY insecure"?

inetnum: 195.0.0.0 - 195.0.7.255
netname: EY-BE
descr: Ernst and Young
descr: Audit Services, Tax Consultants
descr: Accountants, Management Consultants

inetnum: 195.0.8.0 - 195.0.8.255
netname: EUROGENTEC
descr: Seraing

inetnum: 195.0.10.0 - 195.0.10.255
netname: HYPERVISION-BE
descr: Multimedia Productions

inetnum: 195.0.12.0 - 195.0.12.255
netname: INDEX
descr: Koksijde

Etc, etc, etc, etc, etc, etc, etc ...

195.* is several (> 50000) C-class networks spread all over Europe, so
you'll be blocking a lot of innocent people with your configuration.

Robert
--
Robert Hallgren <sand...@swipnet.se>

PGP: http://www.lipogram.com/pgpkey.asc
5F1E 95C2 F0D8 25A3 D1BE 0F16 D426 34BD 166A 566C

Tim Haynes

unread,

Nov 30, 2000, 3:00:00 AM11/30/00

"Anonymous" <n...@spam.com> writes:

> You make some good points, Joe.
>
> > NO. All you wind up doing is providing the offending party with a means
> > to DOS your entire website. When an party is attacking a website, and
> > the site decides to dynamically deny them access based on the reported
> > IP address, the following attempts will undoubtedly be addressed from
> > AOL's proxy servers.
>
> A user who attacks a site through AOL is hard to classify as a major
> threat because they are a "script kiddie" more times than none.

You believe that an AOL IP# coming in is really from AOL? Try again...

> For the user to DOS my server, they would have to do a D.D.O.S
> (distributed denial of service) to simply overflow it ...

No they wouldn't, they'd have to spoof a few simple IP#s (preferably ISP'
web-caches) and trip your logs from each of them, then you'd do the job for
them.

> > These incidents need to be reported to the responsible ISP. Web servers
> > don't work like ftp servers, so progressively slowing your responses
> > down is tricky due to the sessionless nature of http.
>
> I ALWAYS report the miscreant children to their ISP; the problem being
> that overseas ISPs turn a blind eye.
> So I simply ban their entire net (as I did in the case of the 195
> network)

Which `195 network'? 195.b.c.d is *by definition* 65536 networks, you
should probably choose with a little more care.

> Ideally, my program (looks like I'll start the dev/planning stage
> tonight) will send an email to a specified email address with an hourly
> report. The program will also log the IPs, time, etc, etc ...
>
> Any input would be greatful ...

Do it in perl. It's a piece of cake to write something that parses the
lines, selects a few interesting ones, maintains state of how many failed
attempts on each user there've been, and flushes state every few minutes.
You can even have it running with something like
tail --follow=name /var/log/apache/error_log | ~/Perl/userfail.pl
and make it mail you when things go wrong.

(I wrote the equivalent script for processing firewall logs a couple of
weeks ago. Dead easy. When your site gets 311000 failed packets a day, it's
good to be able to break them down into host, port and host+port targets!)

~Tim
--
You take your message to the waters, | pig...@glutinous.custard.org
And you watch the ripples flow | http://piglet.is.dreaming.org

James

unread,

Nov 30, 2000, 3:00:00 AM11/30/00

> You believe that an AOL IP# coming in is really from AOL? Try again...

When you trace their connection (ie on the outbound packet headders) it
always gives their final location away.

> No they wouldn't, they'd have to spoof a few simple IP#s (preferably ISP'
> web-caches) and trip your logs from each of them, then you'd do the job
for
> them.

Really? How so?

> Which `195 network'? 195.b.c.d is *by definition* 65536 networks, you
> should probably choose with a little more care.

I will not give out the specifics for obvious reasons. In any event,
195 is a class B anyways .. it's not 65536 networks. You confused networks
with hosts.

> Do it in perl. It's a piece of cake to write something that parses the
> lines, selects a few interesting ones, maintains state of how many failed
> attempts on each user there've been, and flushes state every few minutes.
> You can even have it running with something like
> tail --follow=name /var/log/apache/error_log | ~/Perl/userfail.pl
> and make it mail you when things go wrong.
>
> (I wrote the equivalent script for processing firewall logs a couple of
> weeks ago. Dead easy. When your site gets 311000 failed packets a day,
it's
> good to be able to break them down into host, port and host+port targets!)

True, but these simple scripts are terribly inefficient, and hog
valuable resources.

James

unread,

Nov 30, 2000, 3:00:00 AM11/30/00

> Why would "the 195 net" be "VERY insecure"?

Some networks lack simple security implementations, thus making them
insecure.

> 195.* is several (> 50000) C-class networks spread all over Europe, so
> you'll be blocking a lot of innocent people with your configuration.

I did not deny ALL of 195.*.*.* I just did not publish specifics (for
obvious reasons)

Joe Schaefer

unread,

Nov 30, 2000, 3:00:00 AM11/30/00

"James" <n...@spam.com> writes:

> > You believe that an AOL IP# coming in is really from AOL? Try again...
>
> When you trace their connection (ie on the outbound packet headders) it
> always gives their final location away.

Could your be more specific?

>
> > No they wouldn't, they'd have to spoof a few simple IP#s (preferably ISP'
> > web-caches) and trip your logs from each of them, then you'd do the job
> for
> > them.
>
> Really? How so?

How not?

>
> > Which `195 network'? 195.b.c.d is *by definition* 65536 networks, you
> > should probably choose with a little more care.
>
> I will not give out the specifics for obvious reasons. In any event,
> 195 is a class B anyways .. it's not 65536 networks. You confused networks
> with hosts.

According to RFC1466, it is a class C network.

>
> True, but these simple scripts are terribly inefficient, and hog
> valuable resources.

Sounds rather trollish again, James. People are trying to help, and you
persist in trying to show them up. Why is that?

(And please don't drop the attribution of the post that you're responding
to, so we know who you're arguing with this time.)

--
Joe Schaefer

Joe Schaefer

unread,

Nov 30, 2000, 3:00:00 AM11/30/00

"James" <n...@spam.com> writes:

> > --
> > Joe Schaefer
>
> Is this to your liking?
>
> Besides, it not a matter of whom I address, it is the issue (I thought
> that the mere linearity of responses was enough; turns out I'm wrong)

No James, that is not to my liking- you included a signature, which is
decidedly unpreferable. The attribution goes at the top, and is generated
by a properly working newsreader whenever you respond to a post. Often
posts to usenet are received out-of-sequence, and including the
attribution at the top lets people see who you are replying to.

For an example, see the top of this reply. I am not trying to pick
a fight with you, and I'm pretty sure you're not trying to do that
either. However, occasionally the tone of your responses can be
misinterpreted, and when you don't follow established norms in a
particular newsgroup, it only compounds the confusion.

Instead of wasting everyone's bandwidth on style issues, lets stick
to substance in the future, OK?

Best.
--
Joe Schaefer

James

unread,

Nov 30, 2000, 8:28:32 PM11/30/00

> > When you trace their connection (ie on the outbound packet headders)
it
> > always gives their final location away.
>
> Could your be more specific?

How does an outbound packet make it to its final destination? There are
a number of ways to track network traffic some of which include stack
dumping the tcp packets and analyzing the outbound IP headder, then from
there, any number of seguays are encountered, and if you are able to contact
the sysop, you request ip traffic at a specific time, etc, etc ...

> > > No they wouldn't, they'd have to spoof a few simple IP#s (preferably
ISP'
> > > web-caches) and trip your logs from each of them, then you'd do the
job
> > for
> > > them.
> >
> > Really? How so?
>
> How not?

Oh, as if the question wasnt obvious enough ... let me re-phrase: how
is this accomplished? I was not aware of such techniques.

> > > Which `195 network'? 195.b.c.d is *by definition* 65536 networks, you
> > > should probably choose with a little more care.
> >

> According to RFC1466, it is a class C network.

I stand corrected; Actually, once I posted (and really thought about it
.. I realized my folly)

> > True, but these simple scripts are terribly inefficient, and hog
> > valuable resources.
>
> Sounds rather trollish again, James. People are trying to help, and you
> persist in trying to show them up. Why is that?

Trollish? You spend too much time alone with your computer. I was
simply saying that whenever you use a script interpreter, or a series of
scripts, it wreaks havoc on your system resources ... I merely wish to
streamline the process ... I may go as far as to pick up an i386 assembly
book and read through it .. because as we all know, gen 1 + 2 coding are
undeniably the cleanest and most efficient methods of coding.

> (And please don't drop the attribution of the post that you're responding
> to, so we know who you're arguing with this time.)
>

> --
> Joe Schaefer

Is this to your liking?

Besides, it not a matter of whom I address, it is the issue (I thought
that the mere linearity of responses was enough; turns out I'm wrong)

Sheesh,

James

Anonymous

unread,

Dec 1, 2000, 3:00:00 AM12/1/00

"Joe Schaefer" <joe+u...@sunstarsys.com> wrote in message
news:m3d7fcu...@mumonkan.sunstarsys.com...

> No James, that is not to my liking- you included a signature, which is
> decidedly unpreferable.

Note, see your signature in message below.

> The attribution goes at the top, and is generated
> by a properly working newsreader whenever you respond to a post. Often
> posts to usenet are received out-of-sequence, and including the
> attribution at the top lets people see who you are replying to.

Oh, you mean like I have done above? It's not difficult .. please
"properly working" .. try properly _configured_

> For an example, see the top of this reply. I am not trying to pick
> a fight with you, and I'm pretty sure you're not trying to do that
> either. However, occasionally the tone of your responses can be
> misinterpreted, and when you don't follow established norms in a
> particular newsgroup, it only compounds the confusion.

Do you by any chance work for a government agency? If there a
particular form that I need to fill out to indicate my intent to file a
request for training in said "norms"

> Instead of wasting everyone's bandwidth on style issues, lets stick
> to substance in the future, OK?

Hey, I'm not the one who's a stickler about form! Besides, this "form"
isn't even a professional template.

> Best.
> --
> Joe Schaefer

Whatever happened to "signature ... decidedly unpreferable" ?

- James

[ this space intentinaly left blank ]

- that aught to get your goat ...

William R. Mattil

unread,

Dec 2, 2000, 3:00:00 AM12/2/00

In article <8ofV5.7476$7.23...@quark.idirect.com>,

Anonymous <n...@spam.com> wrote:
>You make some good points, Joe.
>
>> NO. All you wind up doing is providing the offending party with a means
>> to DOS your entire website. When an party is attacking a website, and
>> the site decides to dynamically deny them access based on the reported
>> IP address, the following attempts will undoubtedly be addressed from
>> AOL's proxy servers.
>
> A user who attacks a site through AOL is hard to classify as a major
>threat because they are a "script kiddie" more times than none.

> For the user to DOS my server, they would have to do a D.D.O.S
>(distributed denial of service) to simply overflow it ...
>

>> These incidents need to be reported to the responsible ISP. Web servers
>> don't work like ftp servers, so progressively slowing your responses
>> down is tricky due to the sessionless nature of http.
>
> I ALWAYS report the miscreant children to their ISP; the problem being
>that overseas ISPs turn a blind eye.
> So I simply ban their entire net (as I did in the case of the 195
>network)
>

> Ideally, my program (looks like I'll start the dev/planning stage
>tonight) will send an email to a specified email address with an hourly
>report. The program will also log the IPs, time, etc, etc ...
>

James,

While you might be more comfortable in C (original post indicates this)
something of this nature was the reason perl was invented. What you want
could be fleshed out in probably 30 minutes in perl. Now with that being
said, you'd better believe that there will be a performance hit from doing
this. Your original post indicates a rather busy web server with a lot
of I/O and (sic) a lot of logging. IMHO Disk I/O would be the limiting
factor here not CPU. You could do this. Easily too. But at what price ?

Regards

Bill

--
William R. Mattil | Fred Astaire wasn't so great.
wrma...@ix.netcom.com | Ginger had to do it all backwards
(972) 399-4106 | and... in high heels.

William R. Mattil

unread,

Dec 2, 2000, 3:00:00 AM12/2/00

(I'm probably going to regret this ......)

In article <pVAV5.28300$3u1.6...@news3.rdc1.on.home.com>,

James <n...@spam.com> wrote:
>> Why would "the 195 net" be "VERY insecure"?
>

> Some networks lack simple security implementations, thus making them
>insecure.

Could you please enlighten us as to what IYHO these might be ???

And how this could be implemented and still allow proper use ?
(referencing your original post here)

>
>> 195.* is several (> 50000) C-class networks spread all over Europe, so
>> you'll be blocking a lot of innocent people with your configuration.
>

> I did not deny ALL of 195.*.*.* I just did not publish specifics (for
>obvious reasons)
>
>

Bill

James

unread,

Dec 2, 2000, 3:00:00 AM12/2/00

"William R. Mattil" <w...@galileo.telcom.com.ix.netcom.com> wrote in message
news:rgoa09...@ptolemy.telcom.com...

> While you might be more comfortable in C (original post indicates this)
> something of this nature was the reason perl was invented. What you want
> could be fleshed out in probably 30 minutes in perl. Now with that being
> said, you'd better believe that there will be a performance hit from doing
> this. Your original post indicates a rather busy web server with a lot
> of I/O and (sic) a lot of logging. IMHO Disk I/O would be the limiting
> factor here not CPU. You could do this. Easily too. But at what price ?

Interesting point about the overhead. I suppose the majority of
overhead _would_ be disk I/O.
With this in mind, does anybody have any links to good perl tutorials /
resources ? I'd like to get
this done as quickly as possible ... TIA

-James

James

unread,

Dec 2, 2000, 3:00:00 AM12/2/00

"William R. Mattil" <w...@galileo.telcom.com.ix.netcom.com> wrote in message

news:12pa09...@ptolemy.telcom.com...

> > Some networks lack simple security implementations, thus making them
> >insecure.
>
> Could you please enlighten us as to what IYHO these might be ???

Surely! There are a large number of point-to-point sites out there
which allow unilateral proxy services; all without logging or rulesets.
This allows a malicious user to attack a site from one of these insecure
proxies (keeping their true IP address safely hidden). Most of these proxy
sites allow this type of connectivity without the sysop's knowledge (thus
making them insecure).

As far as the implementations go, many sites aren't up-to-date on their
security patches (reference BIND 8.2 patchlevel < 7)

> And how this could be implemented and still allow proper use ?
> (referencing your original post here)

Having a system in place where a blatant attempt to brute force crack a
password would result in a temporart (2 hour [or user definable]) ban.
This would allow proper use for those users who are legitimate yet denying
the malicious "skript-kiddiez".

-James

Joe Schaefer

unread,

Dec 2, 2000, 3:00:00 AM12/2/00

"James" <n...@spam.com> writes:

> "William R. Mattil" <w...@galileo.telcom.com.ix.netcom.com> wrote in message

^^^

I think if you fill in these dots in more often, more of us will
understand where you are coming from (although I'm afraid it may be
too late for a few). IMHO usenet works best when there's a two-way
flow of ideas: .. doesn't .. clear what .. point ..

Take a look at mod_throttle -

http://www.snert.com/Software/mod_throttle/

it's not what you seem to want, but you might be able to
get it to work ( it's closer to how I first recommended
you deal with it. )

For Perl, the camel book (_Programming Perl_, by Wall et.at.) is
authoritative- you can check around www.perl.com for recommended
tutorials.)

HTH
--
Joe Schaefer

William R. Mattil

unread,

Dec 2, 2000, 3:00:00 AM12/2/00

In article <mFaW5.41055$3u1.10...@news3.rdc1.on.home.com>,

James <n...@spam.com> wrote:
>"William R. Mattil" <w...@galileo.telcom.com.ix.netcom.com> wrote in message

James,

Probably a misunderstanding. When you said networks I assumed you
meant something totally different. Now had you said "hosts" then
I would tend to agree with you.

Regards

James

unread,

Dec 2, 2000, 3:00:00 AM12/2/00

"William R. Mattil" <w...@galileo.telcom.com.ix.netcom.com> wrote in message

news:fqnb09...@ptolemy.telcom.com...

> Probably a misunderstanding. When you said networks I assumed you
> meant something totally different. Now had you said "hosts" then
> I would tend to agree with you.

Oops, good point ... I forgot that most of us here are far more
sophisticated that the _average_ user, sorry.
Yes, what I meant to say was that there are a startlingly large number
of publicly avaliable proxies out there. I recently spent a few hours
browsing the HTTP hacking / cracking pages out there and compiled a nice
list of proxy sites to ban. I'll post a list if anyone requests it.

Only problem seems to be the feutility of my efforts ... it's almost
comparable to Lennagen vs. the Ants. The force of the "enemy" is
relentless...

Again, my apologies for all misunderstandings.

-James

James

unread,

Dec 2, 2000, 3:00:00 AM12/2/00

"Joe Schaefer" <joe+u...@sunstarsys.com> wrote in message

news:m3k89ir...@mumonkan.sunstarsys.com...

> Take a look at mod_throttle -
>
> http://www.snert.com/Software/mod_throttle/

I had a look at what the module does ... wow ... pretty impressive ..
perhaps I should implement this simply as piece of mind.

> For Perl, the camel book (_Programming Perl_, by Wall et.at.) is
> authoritative- you can check around www.perl.com for recommended
> tutorials.)

I'll have a look for that book ... I think I'll also stop by the local
Chapters.
Thanks for the help Joe.

-James

Joe Schaefer

unread,

Dec 2, 2000, 3:00:00 AM12/2/00

"James" <n...@spam.com> writes:

> Thanks for the help Joe.

You're welcome, James ... thanks for
filling in the dots for me ;)

Best.
--
Joe Schaefer

James

unread,

Dec 3, 2000, 3:00:00 AM12/3/00

Hi guys!

Here's a list of public proxies that have all been used as an attempt to
hack my system.
Just drop this in to your hosts.deny and enjoy 8-)

<-------------------- BEGIN LIST ----------------------->

<-------------------- END LIST ----------------------->

Michael Erskine

unread,

Dec 4, 2000, 3:00:00 AM12/4/00

Anonymous wrote:
>
> "Jan Novák" <ro...@hotmail.com> wrote in message
> news:903sjh$1jm2$1...@news.vol.cz...
>

> > What about cron with some script for reading access_log and deniig address

> > with ipchains?
>
> Obviously the program will be cron driven ... but denying with ipchains
> is a little overboard; besides, it will have to have timing logic enough to
> release the offending IP address after a user definable time.

I am not certain that it is really going overboard. If you have a clear
attempt to crack your site which has failed, what is to stop the cracker
from trying another entry point? Even so that is your choice. You could
also do something with logsurfer or one of the other log processing languages
and insert and remove a port specific deny/reject rule.

Two crontabs one to set the deny, one to remove it...

>
> > If you have so big website u can be able to write simple
> > script by yourself.
>

> Just because somebody has a popular/big website doesnt mean they are a
> guru. If you would have spent a little more time reading my post you would
> have seen the section where I say:
>
> "Can anybody help me out here? Or do I have to pick up my old C books and
> start coding?"
> -see first post
>
> Was that not obvious enough for you?
>
> Anyhoo ...

--
You can fool some of the people all of the time and you can fool all of
the people some of the time but you can not fool all of the people all
of the time. A. Lincoln

Michael Erskine

unread,

Dec 4, 2000, 3:00:00 AM12/4/00

Joe Schaefer wrote:

>
> "Jan Novák" <ro...@hotmail.com> writes:
>
> > What about cron with some script for reading access_log and deniig address

> > with ipchains ? If you have so big website u can be able to write simple
> > script by yourself.
> >
>

Yep, and from what I have seen denying AOL at any time is not such a
bad idea... ;)

>
> These incidents need to be reported to the responsible ISP. Web servers
> don't work like ftp servers, so progressively slowing your responses
> down is tricky due to the sessionless nature of http.

Actually though, Joe has a good point here. How many sites could he
cause you to deny automatically and how quickly? He could cut you completely
off, fairly quickly.

>
> --
> Joe Schaefer

Michael Erskine

unread,

Dec 4, 2000, 3:00:00 AM12/4/00

Joe Schaefer wrote:

> > I will not give out the specifics for obvious reasons. In any event,
> > 195 is a class B anyways .. it's not 65536 networks. You confused networks
> > with hosts.
>

> According to RFC1466, it is a class C network.

Actually I think (if it is a class B) that it is any or 256 class B networks
having 65534 hosts per network... I might be off a bit but:

195.0.0.0/255.255.0.0 Would be one class B with 65534 hosts, one network
number
and one broadcast address. Now I know the RFC's have changed with regards to
the lowest address in a network being reserved for the network address so
don't
tag me on that... I still treat it as a network address.

Which means:

195.0-254.0.0/255.255.0.0 would be 256 class B addresses each with 2^16 - 2
available host addresses.

With all that said, Tim, and I fully agree with your position that it is best
to say 195.0.0.0 represents a network of 65000+ hosts, I block whole
countries.

Send me enough SPAM and I will block your country. It usually takes me a
month or more to get sick of blocking out Class C and Class B subnets, before
I just say, "Aw, to hell with it! I am blocking the entire country."

Another policy I have just started is to locate the email addresses of the
admin, billing, and technical rep for the offending network and warn them that
they have 14 days to make it stop... if they don't I just start bouncing ALL
mail from their network back to THEIR addresses.

Michael Erskine

unread,

Dec 4, 2000, 3:00:00 AM12/4/00

James wrote:

> Trollish? You spend too much time alone with your computer. I was
> simply saying that whenever you use a script interpreter, or a series of
> scripts, it wreaks havoc on your system resources ... I merely wish to
> streamline the process ... I may go as far as to pick up an i386 assembly
> book and read through it .. because as we all know, gen 1 + 2 coding are
> undeniably the cleanest and most efficient methods of coding.
>

James, certain tasks are best programmed in assembler, others
are best programmed in C, still others in an object oriented
language or a 4GL.

If you feel you need to process logs using assembler, you
most certainly have not got enough programming experience
to be writing code that can be exploited via a buffer overflow
which has been written into the log file you are processing.

Use Perl, or AWK, both are much safer for that work. They
both run quickly enough and the task will take a day rather
than a week (or a month).

>
--
http://osiris.urbanna.net/tao.html

Michael Erskine

unread,

Dec 4, 2000, 3:00:00 AM12/4/00

"William R. Mattil" wrote:
>
> In article <8ofV5.7476$7.23...@quark.idirect.com>,
> Anonymous <n...@spam.com> wrote:
> >You make some good points, Joe.
> >

> >> NO. All you wind up doing is providing the offending party with a means
> >> to DOS your entire website. When an party is attacking a website, and
> >> the site decides to dynamically deny them access based on the reported
> >> IP address, the following attempts will undoubtedly be addressed from
> >> AOL's proxy servers.
> >

> > A user who attacks a site through AOL is hard to classify as a major
> >threat because they are a "script kiddie" more times than none.
> > For the user to DOS my server, they would have to do a D.D.O.S
> >(distributed denial of service) to simply overflow it ...
> >

> >> These incidents need to be reported to the responsible ISP. Web servers
> >> don't work like ftp servers, so progressively slowing your responses
> >> down is tricky due to the sessionless nature of http.
> >

> > I ALWAYS report the miscreant children to their ISP; the problem being
> >that overseas ISPs turn a blind eye.
> > So I simply ban their entire net (as I did in the case of the 195
> >network)
> >
> > Ideally, my program (looks like I'll start the dev/planning stage
> >tonight) will send an email to a specified email address with an hourly
> >report. The program will also log the IPs, time, etc, etc ...
> >
>
> James,
>

Bill,

If he maintains state, benchmarks the point where he left off in the log,
overhead will be minimal. Sure it will be slower than C or assembler.

It will be a problem only if he is marginal in his ability to process his
volume of hits already.

>
> Regards
>
> Bill
>
> --
> William R. Mattil | Fred Astaire wasn't so great.
> wrma...@ix.netcom.com | Ginger had to do it all backwards
> (972) 399-4106 | and... in high heels.

--
Remember it's one piece of string, two bits of wood, three feathers, all
the rest is propaganda. The only accuracy requirement is to be able to hit
a Frenchman on a horse at 200 paces or on foot at 60.

Tim Haynes

unread,

Dec 4, 2000, 3:00:00 AM12/4/00

Michael Erskine <osi...@urbanna.net> writes:

[snip]

> Actually though, Joe has a good point here. How many sites could he cause
> you to deny automatically and how quickly? He could cut you completely
> off, fairly quickly.

Choose a few big *I*SP's web-caches as your source-IP, wahey, party.
Quietly.

~Tim
--
4:19pm up 111 days, 18:52, 11 users, load average: 0.11, 0.06, 0.01
pig...@glutinous.custard.org |There's a lighthouse, Shining in the black,
http://piglet.is.dreaming.org |A lighthouse, Standing in the dark

Tim Haynes

unread,

Dec 4, 2000, 3:00:00 AM12/4/00

"James" <n...@spam.com> writes:

> > You believe that an AOL IP# coming in is really from AOL? Try again...
>

> When you trace their connection (ie on the outbound packet headders) it
> always gives their final location away.
>

> > No they wouldn't, they'd have to spoof a few simple IP#s (preferably ISP'
> > web-caches) and trip your logs from each of them, then you'd do the job
> for
> > them.
>
> Really? How so?

Set the apparent source IP# to www-cache.demon.co.uk, target a site with a
`sysadmin' who thinks tripping a firewall automatically on too many
connection attempts to dodgy ports is cool, bingo.

> > Which `195 network'? 195.b.c.d is *by definition* 65536 networks, you
> > should probably choose with a little more care.
>

> I will not give out the specifics for obvious reasons. In any event,
> 195 is a class B anyways .. it's not 65536 networks. You confused networks
> with hosts.

__host/net divider ;)
/
It's *B*? I thought C, in which case 195.x.y|.0 would be
256 for x *
256 for y
_____
65535 networks (give or take).

(What's that blinkin' RFC that says what the class is per initial-octet
range?)

> > (I wrote the equivalent script for processing firewall logs a couple of
> > weeks ago. Dead easy. When your site gets 311000 failed packets a day,
> > it's good to be able to break them down into host, port and host+port
> > targets!)
>

> True, but these simple scripts are terribly inefficient, and hog
> valuable resources.

Not around here it doesn't. OK, so it appears in _top_, but it's in the
last two lines in my 80x25 terminal, below _mon_, httpd, kpiod, atd, crond,
sshd, xntpd, sendmail and one or two other sundries. This is not what I'd
call a resource hog.

~Tim
--
4:40pm up 111 days, 19:12, 11 users, load average: 0.07, 0.05, 0.01
pig...@glutinous.custard.org |Sometimes you're the pigeon,
http://piglet.is.dreaming.org |Sometimes you're the statue.

Tim Haynes

unread,

Dec 4, 2000, 3:00:00 AM12/4/00

Tim Haynes <pig...@glutinous.custard.org> writes:

[snip]

> ~Tim

I forgot to say, I've missed a lot of articles in this thread, apparently,
but thought James' would benefit from a response from me, seeing as my
oh-so-controversial ideas are the parent of the thread ;)

Oh, and before I forget again:
admin# grep -Ec '^Dec 4' /var/log/firewall_remote.log
5085
admin# grep -Ec 'Nov 29' /var/log/firewall_remote.log
6389
admin# grep -Ec '^Nov 30' /var/log/firewall_remote.log
8004

We have a few firewall problems a day here... ;]

~Tim
--
Can you tell me how to get, | pig...@glutinous.custard.org
How to get to Sesame Street? | http://piglet.is.dreaming.org

James

unread,

Dec 4, 2000, 7:14:48 PM12/4/00

"Michael Erskine" <osi...@urbanna.net> wrote in message
news:3A2BC515...@urbanna.net...

> If you feel you need to process logs using assembler, you
> most certainly have not got enough programming experience
> to be writing code that can be exploited via a buffer overflow
> which has been written into the log file you are processing.

Do you presume to say that I do not know how to program in assembler?
LOL !
How else do you figure I earn my living ?!

FYI: I said that I was going to do it in C !!

> Use Perl, or AWK, both are much safer for that work. They
> both run quickly enough and the task will take a day rather
> than a week (or a month).

Dont know where you work (or how you program) but a week or a month is
almost an entire project ... this is a one day effort.

-James

Tim Haynes

unread,

Dec 5, 2000, 3:00:00 AM12/5/00

"James" <n...@spam.com> writes:

[snip]

> Do you presume to say that I do not know how to program in assembler?
> LOL !
> How else do you figure I earn my living ?!
>
> FYI: I said that I was going to do it in C !!
>
> > Use Perl, or AWK, both are much safer for that work. They
> > both run quickly enough and the task will take a day rather
> > than a week (or a month).
>
> Dont know where you work (or how you program) but a week or a month is
> almost an entire project ... this is a one day effort.

Cool. Make sure you post a link to it when you're finished then - I need
something to take the load off my G3 :8]

~Tim
--
They did a dance called America | pig...@glutinous.custard.org
They danced it round | http://piglet.is.dreaming.org
And waited at the turns |

Anonymous

unread,

Dec 5, 2000, 3:00:00 AM12/5/00

Update:

Looks like I'll take the advice of a number of people and just kludge a
few awk and sed scripts to achieve what I initialy set out for.

Here's an example of what I've done:

< -------------------------------------------------------
END ------------------------------------------------------->

# This checks the /var/log/error_log for rejected usernames and creates
# a log files: banned_log (IP)
# This is useful for auto-banning brute force attacks

# Take all the failed logins (due to non-existant username) and place in
banned_log

grep 'not found' /var/log/error_log > /var/log/temp

# Remove all "innocent" rejected logins"

grep -v 'oldloginhere' /var/log/temp > /var/log/banned_log
rm -f /var/log/temp

# Take all the IP addresses from temp and place them in ip_banned

awk -f /etc/cron.hourly/awk1 /var/log/banned_log > /var/log/ip_banned

# Remove all ] characters from the ip_banned

sed -e 's/]//g' /var/log/ip_banned > /var/log/temp
rm -f /var/log/ip_banned
mv /var/log/temp /var/log/ip_banned

# Sort list for duplicates, and count the repititions then output as
follows:
# <numtimes_repeated> <data>

uniq -c /var/log/ip_banned > /var/log/uniq_banned
rm -f /var/log/ip_banned

# Because the output count will have numbers such as '1' we need to change
the
# format of the first column to have a # so we can ignore that column
(remove it) with grep
# ie. the formatted file looks like this:
# 1 192.168.0.1
# 2 192.168.0.6
# 5 192.168.0.9
# we want it to look like this:
# #1 192.168.0.1
# #2 192.168.0.6
# #5 192.168.0.9

awk -f /etc/cron.hourly/awk2 /var/log/uniq_banned > /var/log/frmat_banned
rm -f /var/log/uniq_banned

# Take the formatted list (repitition counted) and take only those with a
count of x or > and
# place it in a new banned_log file
#
# This ensures that only true abusers get banned by giving all hack attempts
x free tries
# vvvv ---- this value is the "x" referred to above

grep -v '#1' /var/log/frmat_banned > /var/log/raw_banned
rm -f /var/log/frmat_banned

# Now we need to remove the #<number> column so we can import it into the
hosts.deny

awk -f /etc/cron.hourly/awk3 /var/log/raw_banned > /var/log/banned_log
rm -f /var/log/raw_banned

# And TADA! We are left with a file named: banned_log which contains a
list of abusive IP addresses

< -------------------------------------------------------
END ------------------------------------------------------->

$kr1pt...@salmahayeksknockers.edu

unread,

Dec 5, 2000, 10:18:02 PM12/5/00

Anon, you appear to be a prime candidate for learning perl. A basic
understanding of awk and sed is nice for simple use, but for scripting tasks
like this, perl is really the way to go. It is very easy to learn, and you'll
thank me later. Check out this site to start learning:

http://www.comp.leeds.ac.uk/Perl/basic.html

Anonymous <n...@spam.com> wrote:
> Update:

> < -------------------------------------------------------
> END ------------------------------------------------------->

--
............................................................................

"What sort of truth is it that needs protection?"

-Auberon Waugh, The London Daily Telegraph

...........................................................................
www.geocities.com/pentagon/bunker/1022 swan_...@my-dejanews.com

Ian Jones

unread,

Dec 6, 2000, 12:00:15 AM12/6/00

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

<$kr1pt...@salmahayeksknockers.edu> wrote

> Anon, you appear to be a prime candidate for learning perl. A
> basic understanding of awk and sed is nice for simple use, but for
> scripting tasks like this, perl is really the way to go. It is
> very easy to learn, and you'll thank me later. Check out this site
> to start learning:
>
> http://www.comp.leeds.ac.uk/Perl/basic.html

I wholeheartedly agree!! Go to your nearest geek-mart and ask the guy
for "The Camel Book". Two hours later you will be itching to rewrite
your script in perl. (It is a fine script, BTW).

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>
Comment: Making the world safe for geeks.

iQA/AwUBOi3FJMAVSpfzXItKEQL8tACglfqKen+ctyseEyPTk8YboCOMDykAn0/J
P1w4flmUn0vieWTgH6h4QUW2
=5QBw
-----END PGP SIGNATURE-----

Joe Schaefer

unread,

Dec 6, 2000, 3:00:00 AM12/6/00

"Ian Jones" <i...@dsl081-056-052.dsl-isp.net> writes:

> <$kr1pt...@salmahayeksknockers.edu> wrote
> > Anon, you appear to be a prime candidate for learning perl. A
> > basic understanding of awk and sed is nice for simple use, but for
> > scripting tasks like this, perl is really the way to go. It is
> > very easy to learn, and you'll thank me later. Check out this site
> > to start learning:
> >
> > http://www.comp.leeds.ac.uk/Perl/basic.html
>
> I wholeheartedly agree!! Go to your nearest geek-mart and ask the guy
> for "The Camel Book". Two hours later you will be itching to rewrite
> your script in perl. (It is a fine script, BTW).

It would also be useful to see the apache log config, sample raw data
from the apache logs, and the size of the file being parsed. mod_log_config
can do a lot of the filtering for you, and it has a facility similar to
syslogd for piping output directly to a script (assuming the apache version
is realtively modern).

--
Joe Schaefer

Anonymous

unread,

Dec 6, 2000, 3:00:00 AM12/6/00

<$kr1pt...@salmahayeksknockers.edu> wrote in message
news:KdiX5.37661$sz3.7...@news1.telusplanet.net...

> Anon, you appear to be a prime candidate for learning perl. A basic
> understanding of awk and sed is nice for simple use, but for scripting
tasks
> like this, perl is really the way to go. It is very easy to learn, and
you'll
> thank me later. Check out this site to start learning:
>
> http://www.comp.leeds.ac.uk/Perl/basic.html

Thanks to all who have replied ... I'll be picking up a perl book
tonight 8-)

Close examination of the script will show a fatal flaw (the grep -v #1
..) part ... oops excluded all attempt counts with first digit "1"
Ie. skipped 100, 1000, 10'000 [can we say screwup?]
So I changed the reformatting to have an end of count marker (ie. #1#
and #1000#)
Now it greps #1#, #2# and #3# to give the person a break 8-)

Thanks again!

-James

Anonymous

unread,

Dec 6, 2000, 3:00:00 AM12/6/00

"Anonymous" <n...@spam.com> wrote in message
news:_jeX5.9300$7.33...@quark.idirect.com...
> Update:

> grep -v '#1' /var/log/frmat_banned > /var/log/raw_banned

Big oops! This ignores ALL lines with a count begging with a "1". Ie.
ignores #1000 or #1'000'000
I had to change the formatting to #number#

grep -v '#1#' /var/log/frmat_banned > /var/log/raw_banned

This one works ...

LOL

That's what you get for completely writing out a script and not testing
it along the way.

It's working now ... and I added a finalizing formatting to output the
banned IPs like so:

<tab> Deny from <ip> # Auto-generated shit-list <date>

If there are any requests, I might tarball the scripts and make them
avaliable for all those who don't quite have a handle on grep or awk.

$kr1pt...@salmahayeksknockers.edu

unread,

Dec 9, 2000, 1:58:44 PM12/9/00

Anonymous <n...@spam.com> wrote:

> Thanks to all who have replied ... I'll be picking up a perl book
> tonight 8-)

James, how did it go? Have you fallen in love yet?

--
...........................................................................

One hundred percent of the shots you don't take don't go in.

- Wayne Gretzky

...........................................................................
www.geocities.com/pentagon/bunker/1022 swan_...@my-dejanews.com

jamesd...@gmail.com

unread,

Nov 1, 2016, 6:33:24 AM11/1/16

On Wednesday, November 29, 2000 at 9:00:00 AM UTC+1, Anonymous wrote:
> Hi all,
>
> Recently, I've had over 200'000 hits a day .. all from people trying to
> crack
> the password proteced areas on my site.
>
> I reacted by simply adding the following to my <Directory> statement:
>
> Deny from 195 ; <- fuck 'em all!
>
> This is a very effective way of denying _ANYONE_ from the 195 net (a VERY
> insecure net!!) from accessing the web server. This requires my user
> intervention to implement.
>
> I was wondering if there is a program out there that can monitor the
> error_log
> file and if a user enters the wrong login/password combo more than 4 times,
> it
> auto-denys the user until either the end of the day, or for the next hour.

>
> Can anybody help me out here? Or do I have to pick up my old C books and
> start
> coding?
>

> -Jms

I want to shear a life changing story with everyone who cares to read this testimony. Blank atm cards are real and are effective all over the world. my name is [JAMES DEO] i live in SPAIN . I got this card from [MR OSCAR ] a month ago. this card has really help me pay my debits and now i am free from all financial problems. I no this is hard to believe , but i never new there was this kind of card until i got one. This card withdraw more than €6000 daily and it is very easy to use. But you have to be very careful in other not to be caught by the police because it is illegal. If you want more information on this card and how to get one just contact the hackers by this address (oscarwhiteh...@gmail.com)

0 new messages