Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is there any fail2ban like software for CentOS 2.6.32-358.6.2.el6.x86_64 ? (fail2ban is 0.8.10 installed) but its slowing down the system completely, i was looking for something which can be similar like fail2ban but more robust.

any idea?

i have this iptables but fail2ban 0.8.10 version is unable to stop random attacks of SIP DoS, as a result the system shutdown while running fail2ban)

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [32:6752]
:fail2ban-SSH - [0:0]
:fail2ban-freeswitch - [0:0]
:fail2ban-freeswitch-dos - [0:0]
-A INPUT -j fail2ban-freeswitch-dos
-A INPUT -j fail2ban-freeswitch
-A INPUT -p tcp -m tcp --dport 22 -j fail2ban-SSH
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5222 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5269 -j ACCEPT
-A INPUT -p udp -m udp --dport 5080 -m string --string "friendly-scanner" --algo bm --to 65535 -j DROP
-A INPUT -p udp -m udp --dport 5060 -m string --string "friendly-scanner" --algo bm --to 65535 -j DROP
-A INPUT -p tcp -m tcp --dport 5081 -j ACCEPT
-A INPUT -p udp -m udp --dport 5081 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5080 -j ACCEPT
-A INPUT -p udp -m udp --dport 5080 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5061 -j ACCEPT
-A INPUT -p udp -m udp --dport 5061 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5060 -j ACCEPT
-A INPUT -p udp -m udp --dport 5060 -j ACCEPT
-A INPUT -p udp -m udp --dport 16000:42000 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -s 178.162.205.224/32 -j DROP
-A INPUT -s 65.55.44.100/32 -j DROP
-A INPUT -s 178.162.205.224/32 -j DROP
-A INPUT -s 91.218.247.162/32 -j DROP
-A INPUT -s 109.135.14.56/32 -j DROP
-A INPUT -s 85.25.78.58/32 -j DROP
-A INPUT -s 91.218.247.162/32 -j DROP

-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A fail2ban-SSH -j RETURN
-A fail2ban-freeswitch -j RETURN
-A fail2ban-freeswitch-dos -j RETURN
COMMIT

EDIT: no Fail2Ban why.

http://serverfault.com/questions/17870/hundreds-of-failed-ssh-logins/17879#17879 http://serverfault.com/a/128964

share|improve this question
1  
Fail2ban is not in any way DoS protection. It was designed to stop basic bot attacks. When it comes to DoS, if the traffic hits your server, you have already lost. Block it upstream. –  jordanm Nov 17 '13 at 4:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.