<p dir="ltr"><br>
Raj:<br>
Yes, I already use fail2ban on the box (you dhould have seen the number of attempts before it was implemented). But thank you for your input. :-) I probably do need to check that I've got all the latest patches for apache, etc. though.</p>
<p dir="ltr">Jim:<br>
I had, nor do I have any intent to violate the attacing boxes, merely sniff around for connections to suspect ports, nmapping them, and possinly mapping and turning in whole blocks of bot-nets at a time- rather than just one ip at a time. I don't know whether that would be legal or not, it really seems no more than what tracking cookies akready do to everybody everyday. But, I guess I could set up a script that would read the logs and send an automated email to whatever the "abuse" contact in a reverse dns lookup would be. I'm abslutely sure that would be legal..</p>
<p dir="ltr">Just not as satisfying.</p>
<div class="gmail_quote">On Jan 1, 2015 9:37 AM, "Jim Kinney" <<a href="mailto:jkinney@jimkinney.us">jkinney@jimkinney.us</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>I understand the frustration. However, the only legal recourse is to block those attempts at your server. Any retaliatory action is both illegal and will violate the ToS of every ISP. There is no such thing as an Internet Stand Your Ground law.<br>
<br>
That said, you can set up a honeypot system and redirect all attacks to it. Or setup longer and longer delays in your firewall rules so every connection attempt takes exponentially longer to get the response back. <br><br><div class="gmail_quote">On December 31, 2014 11:06:27 PM EST, William Wylde <<a href="mailto:durtybill@gmail.com" target="_blank">durtybill@gmail.com</a>> wrote:<blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<p dir="ltr">I run a personal webserver on an isolated connection, and my logs reveal hundreds of failed log- in attempts (particularly from china). Nmap of the various ips reveal suspiciously open ports which make me think that the attacks may be coming from a zombie-box. I intensely hate bot-nets, and have developed a desire to track them and destroy as many as I can find- whomever is running them, thus I have recently installed kali in an openbox VM. Anybody have any experience with using kali in tracking and destroying such nets? </p>
<p style="margin-top:2.5em;margin-bottom:1em;border-bottom:1px solid #000"></p><pre><hr><br>Ale mailing list<br><a href="mailto:Ale@ale.org" target="_blank">Ale@ale.org</a><br><a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>See JOBS, ANNOUNCE and SCHOOLS lists at<br><a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br></pre></blockquote></div><br>
--<br>
Jim Kinney<br>
Linux Systems Analyst<br>
Physicist/Brewer<br>
<a href="http://jimkinney.us" target="_blank">http://jimkinney.us</a></div><br>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
<br></blockquote></div>