You could use snort-inline to detect and block known bad stuff (scans,
worms, etc). As for the 100 hits in 10 seconds... that sounds like a
job for netfilter "rate limiting". Google around the
iptables/netfilter docs and you should find something suitable.
On 8/31/07, Eric Marden <security@xentek.net> wrote:
I've just started with a company running Coldfusion Apps on Windows.
Too much code for me to audit quickly, but need some recommendations
on something we can put at the network perimeter that will sniff
incoming traffic only for weird patterns.... like if a guest book
gets hit 100 times in 10 secs from the same IP it will just start to
block....
It shouldn't worry about outgoing, just incoming.
Didn't think Snort was for this, or other IDS type systems.
Commercial or Open Source (OS Preferred) will be considered. An
Appliance if its Commercial. We need something quick and easy.
The previous engineers had no clue, so I'm untangling knots on the
server/infrastructure side (CF goes down like crazy). The current
Devs, are just not trained in secure coding practices.
I need a blanket solution that will work for the next couple of
months, until I can circle back and help them fix their CF Code.
P.S. - We are starting to look at bl.com and project honeypot's
tools, and like what we see so far, but would like more input.
Thanks in advance!
-= Eric Marden =-
-------------------------------------------------------------------------
Sponsored by: Watchfire
The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online
despite security executives' efforts to prevent malicious attacks. This
whitepaper identifies the most common methods of attacks that we have seen,
and outlines a guideline for developing secure web applications.
Download today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
--------------------------------------------------------------------------
-------------------------------------------------------------------------
Sponsored by: Watchfire
The Twelve Most Common Application-level Hack Attacks
Hackers continue to add billions to the cost of doing business online
despite security executives' efforts to prevent malicious attacks. This
whitepaper identifies the most common methods of attacks that we have seen,
and outlines a guideline for developing secure web applications.
Download today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008rSe
--------------------------------------------------------------------------
