Occasionally, one VPS under my control gets bombarded with POP3 login attempts. They all fail, but the huge number of spawned processes and active connections pretty much amount to a DoS attack.

When I see that going on, I usually go in and manually block the offending IP address in iptables. What I would like is to have a process running on the server monitoring the system log (or some other appropriate place) and, if there are repeat log entries matching a particular pattern, pass them to a command which would then extract the relevant part (the remote host IP address, in this case) and execute a command (to add a DROP rule to iptables). For example, do so if log entries with the same message-part are logged five times within one minute.

The VPS runs syslog-ng in case that helps. I have set up rate limiting in iptables which helps somewhat, but certainly isn't perfect as it blocks my own connection attempts just as much as those of an attacker (it becomes the luck of the draw who gets an established connection). Since the clients that are supposed to connect have IP addresses from dynamic blocks, it's difficult to just add an override rule without rate limiting.

Since the VPS runs on Virtuozzo, while I do have root access to the guest, I cannot load custom kernel modules, or a custom kernel. So it has to be done in userspace.

What software will help me?


I'd recommend fail2ban.

Fail2ban is software which is meant to monitor logs for brute force login attempts. When it see's such an attempt, it blocks the attacker's IP via iptables. After a sufficient amount of time has passed fail2ban will automatically remove the block.

Fail2ban is customizable and can work with just about any type of internet service daemon. There is even specific documentation for pop3 daemons such as courier, dovecot, and qmail.

| improve this answer | |

I use OSSEC (http://www.ossec.net/). It does log analysis but also has active response options (adding and removing iptables and hosts.deny entries on the fly) with minimal setup. It has several default rules but you can add your own. I have tested it and use it in production with CentOS, Ubuntu and Slackware machines (both physical and VPS).

The install is very easy (tuning it, mostly configuring it to ignore some rules, is what it takes more time). If you use it and enable the active response functions the defaults are usually good enough.

I would suggest to leave the default block time (a few minutes), add a whitelist with your IP (or the IP of other server you trust, just in case your IP is not static and the server blocks you).

Also, if you need more complex blocking management, you can configure OSSEC to use a bash (for example) script to check and handle the IP address before doing the actual active blocking.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.