Josip Almasi wrote:
I wonder if something similar could be implemented here? [1]
http://olivier.sessink.nl/publications/blacklisting/index.html
Gonna give it a try right away;)
Well it works allright:)
Here's the script modified for smtp traffic(*).
Trying to think of problems - it may make problems to MTA that opens a
new connection for each msg. But of course there's no such MTA's
around;) But in such a case this method is equivalent to greylisting.
Thanks again for the hint:)
Regards...
*)
#SMTP dynamic blacklist impl
#based on SSH blacklist
#http://olivier.sessink.nl/publications/blacklisting/index.html
# create properREJECT chain that does different rejects for tcp/udp
iptables -N properREJECT
iptables -A properREJECT -p tcp -j REJECT --reject-with tcp-reset
iptables -A properREJECT -j REJECT --reject-with icmp-port-unreachable
#
iptables -N blacklistdrop
iptables -A blacklistdrop -j LOG --log-prefix "adding to BLACKLIST: "
iptables -A blacklistdrop -m recent --name BLACKLIST --set -j DROP
#
#
# on external hosts, do rate limiting on incoming smtp packets, and keep
a black list for 30 seconds
# this rule drops *any* packet if the IP is in the blacklist
# icmp 'destination-unreachable' packets should not update BLACKLIST,
because
# they are generated by our own REJECT rule in the extern_out chain
iptables -A INPUT -m recent --name BLACKLIST --update --seconds 120 -j DROP
#
# all *established* smtp connections simply continue
iptables -A INPUT -p tcp --dport 25 -m state --state ESTABLISHED,RELATED
-j ACCEPT
#
# *new* smtp connections are all put into a list 'smtpconn', and if
there are 3 such packets in 30 seconds
# we send the package to chain 'blacklistdrop' which puts the IP in the
blacklist
iptables -A INPUT -p tcp --dport 25 -m state --state NEW -m recent
--name smtpconn --rcheck --seconds 30 --hitcount 3 -j blacklistdrop
#
# if we have seen less then 3 such packets in the last 30 seconds we accept
iptables -A INPUT -p tcp --dport 25 -m state --state NEW -m recent
--name smtpconn --set -j ACCEPT
#
# if the destination address is in the blacklist, we REJECT *any* packet
iptables -A OUTPUT -m recent --name BLACKLIST --rdest --rcheck --seconds
30 -j properREJECT
#
# outgoing we accept all smtp traffic, with connection tracking
iptables -A OUTPUT -p tcp --sport 25 -m state --state
ESTABLISHED,NEW,RELATED -j ACCEPT
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
