Have you looked at fail2ban? I use it to block IPs that create excessive err log entries for x minutes. I also watch for specific naughty requests like phpmyadmin and block forever.
Sonicwall is exceptionally poor.
I have a CentOS web server that has recently been brought to a halt on two separate occasions. Checking the access.log, it appears that it was a Denial of Service (DOS) attack (hundreds of HTTP requests in a very short time, all from a single IP address).I want to prevent these types of attacks from bringing the server to its knees. We have a hardware firewall (SonicWall) in place, but it isn't quite new enough to run the firmware that allows rate-limiting.I have found a number of tutorials that show how to do this type of thing with IPTABLES. Is there a better solution?Supposing I go with IPTABLES, do I need to include rules to allow FTP and SSH (the only other services on the server)?Would any of you be willing to assist me with this?
_______________________________________________
KCLUG mailing list
KCLUG@kclug.org
http://kclug.org/mailman/listinfo/kclug