<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
You guys are completely on the right track. The only other thing I'd do
is add some kind of logging system so that if an IP gets blacklisted,
we can show WHY it got blacklisted. (X brute force attaches / second,
etc - example passwords tried, etc.) This way if a system gets blocked
that is legitimate, "we" can examine the evidence and see if the claims
of legitimacy are valid etc.<br>
<br>
<br>
<div class="moz-signature">
<p align="left"><font face="Times New Roman, Times, serif" size="1">
<table border="0" width="317">
<tbody>
<tr valigh="top">
<td>
<div align="center"> <a href="http://www.anteil.com"><img
moz-do-not-send="false" src="cid:part1.09090902.07040904@anteil.com"
alt="Anteil, Inc." border="0"></a>
<table border="0" width="317">
<tbody>
<tr>
<td colspan="3">
<div align="center">
<table width="270">
<tbody>
<tr>
<td>
<hr></td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
<tr valign="top">
<td width="134">
<div align="right"><font color="#000000"
face="Times New Roman, Times, serif" size="2"> <strong>Andrew M.
Lauppe<br>
</strong> <em>Consultant</em> </font>
</div>
</td>
<td width="11"><br>
</td>
<td width="148"><font face="Times New Roman, Times, serif"><font
color="#666666" size="1">4051B Executive Park Dr.<br>
Harrisburg, PA 17111<br>
<hr align="left" width="105">+1 (877) OS-LINUX x23<br>
+1 (484) 421-9919 direct </font></font></td>
</tr>
</tbody>
</table>
</div>
</td>
</tr>
</tbody>
</table>
</font></p>
</div>
<br>
<br>
Darren Wiebe wrote:
<blockquote cite="mid:49BEA71B.60103@aleph-com.net" type="cite">
<pre wrap="">JR Richardson wrote:
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">No matter how the system is set up there should be a way to easily add
known-good IP as they relate to a particular installation.
</pre>
</blockquote>
<pre wrap="">The Project Honey Pot looks great.
I'm not too keen on white listing though. It would be hard to verify
an attacker's IP's that hasn't been identified as bad yet. I'm sure
some hackers would troll the black list and try to add their IP's as
known good. I don't think this would be some automated mechanism for
PBX server subscription, at least not yet.
I'm thinking more along the lines of a central list, updated by
community participants, to add IP's that have attacked them, with
date/time of the attack. It would be up to the PBX admin to employ a
filter with those black listed IP's or disregard the list all
together.
Thanks
JR
--
JR Richardson
Engineering for the Masses
_______________________________________________
--Bandwidth and Colocation Provided by <a class="moz-txt-link-freetext" href="http://www.api-digital.com">http://www.api-digital.com</a>--
asterisk-biz mailing list
To UNSUBSCRIBE or update options visit:
<a class="moz-txt-link-freetext" href="http://lists.digium.com/mailman/listinfo/asterisk-biz">http://lists.digium.com/mailman/listinfo/asterisk-biz</a>
</pre>
</blockquote>
<pre wrap=""><!---->This program is specific to SSH but we've been very, very happy with the
way that the denyhosts program works. It shares a list of ip addresses
with a central server. However, it's easy to add your own whitelist
that your system uses. I envision the same sort of functionality here.
</pre>
</blockquote>
</body>
</html>