<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 TRANSITIONAL//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; CHARSET=UTF-8">
<META NAME="GENERATOR" CONTENT="GtkHTML/3.32.2">
</HEAD>
<BODY>
its funny, I have used this approach on several personal servers that got an undeserved amount of attention from APNIC. Originally I followed similar methodology of simply blocking, but after a while I began having fun and using the script to have IP tables NAT all of the attackers back at one of them randomly. Admittedly these were mostly attacks against TCP based services. <BR>
<BR>
It was a lot like having an ant farm full of scammers and software pirates. <BR>
<BR>
Sorry for getting sorta off-topic....<BR>
<BR>
-anorexicpoodle<BR>
<BR>
On Wed, 2011-05-18 at 13:03 -0400, Alex Balashov wrote:
<BLOCKQUOTE TYPE=CITE>
<PRE>
On 05/18/2011 12:59 PM, J. Oquendo wrote:
> On 5/18/2011 12:46 PM, Alex Balashov wrote:
>> Ghetto, but goes a long way in helping harden individual Asterisk
>> servers on which one has no choice but to leave the SIP call agent
>> open to the public Internet:
>
> <A HREF="http://www.infiltrated.net/scripts/moreghetto.txt">http://www.infiltrated.net/scripts/moreghetto.txt</A>
>
> You could also use the VABL to block known idiots:
>
> wget -qO - <A HREF="http://www.infiltrated.net/vabl.txt">www.infiltrated.net/vabl.txt</A> | awk '{print "iptables -A INPUT
> -s "$1" -j DROP" |"sort"}' | uniq | sh
>
Indeed.
I'm a huge fan of <A HREF="http://countries.nerd.dk">http://countries.nerd.dk</A> as a place to get a list of
all non-ARIN net block assignments and firewalling those off.
</PRE>
</BLOCKQUOTE>
<BR>
</BODY>
</HTML>