8000 Ban C Class networks / C-Class-recidive · Issue #953 · fail2ban/fail2ban · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Ban C Class networks / C-Class-recidive #953

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
szepeviktor opened this issue Feb 11, 2015 · 14 comments
Closed

Ban C Class networks / C-Class-recidive #953

szepeviktor opened this issue Feb 11, 2015 · 14 comments

Comments

@szepeviktor
Copy link
Member 
# select first 2 octets of IP-s
# sort by number of occurrences
# TOP10
sqlite3 fail2ban.sqlite3 'select ip from bans;'|cut -d'.' -f1-3 \
    |sort -n|uniq -c|sort -n \
    |tail

Is it a good idea to ban the whole C Class after N bans in it?
@szepeviktor
Copy link
Member Author

My output is

      9 46.174.67
     10 85.195.91
     11 46.118.29
     11 92.63.88
     13 212.129.63
     15 31.204.130
     18 94.23.33
     23 188.40.141
     23 46.105.113
     26 193.104.41

I would set N to 20, that is an 8% density.

@szepeviktor
Copy link
Member Author

Could it be implemented as 1 sqlite query?

@szepeviktor szepeviktor changed the title Ban C Class networks Ban C Class networks / C-Class-recidive Feb 11, 2015
@leeclemens
Copy link
Contributor

@szepeviktor Members of a class C network may not be from the same country - so I think this is not a good idea in practice. What correlation is there between one IP being banned and every other IP in the same class C network (other than being in the same class C network, obviously)?

@szepeviktor
Copy link
Member Author

Here I read that a class C network has 256 IP-s, so 1.2.3.*. Have you seen a C class that spreads over two countries?

@szepeviktor
Copy link
Member Author

BTW. You may keep this limit at 100 to be sure it is a botnet.

@leeclemens
Copy link
Contributor

Yes, that is what a class C address is - if classful networking was still used (see below).

RIR's are responsible for multiple countries - and can (and do) allocate networks to different countries which are both subsets of the same /24 network (e.g. a /25 to an ISP in Germany and the other /25 to an ISP in Ukraine).

There is no basis for what you are attempting to do, so I don't think it matters what limit or threshold - as associating all members of the /24 is flawed logic from the start.

I was using "class C network" as a general term for a /24 network.

From the wikipedia article you cited:
"Classful networking was replaced by Classless Inter-Domain Routing (CIDR), starting in 1993 with the specification of RFC 1518 and RFC 1519...."

@szepeviktor
Copy link
Member Author

Sorry! http://bgp.he.net/ip/193.251.160.151#_whois -> GP
http://bgp.he.net/ip/193.251.160.155#_whois -> FR

@szepeviktor
Copy link
Member Author

Because fail2ban sends me more than 50 emails I still do:

## disable auth from attackers
<FilesMatch "(wp-login|xmlrpc)\.php$">
<Limit POST>
    Order Allow,Deny
    Allow from all
    # BT Italia S.p.A.
    Deny from 78.4.0.0/16
    Deny from 78.5.0.0/16
    Deny from 78.6.0.0/16
    Deny from 78.7.0.0/16
    Deny from 78.7.115.0/24
    # Fastweb S.p.A.
    Deny from 89.96.0.0/15
    Deny from 93.48.0.0/13
    Deny from 93.56.0.0/14
    Deny from 93.60.0.0/15
</Limit>
</FilesMatch>

@szepeviktor
Copy link
Member Author

Do you have something on your mind?

@leeclemens
Copy link
Contributor

@szepeviktor Given what I said and the two IPs you found that are so close, but allocated to different countries, do you still believe it is a good idea to block entire /24's based on one or some number of individual IP's being banned?

@szepeviktor
Copy link
Member Author

No. It is bad idea.

@szepeviktor
Copy link
Member Author

Could you help me reduce the number of emails? Maybe based on whois netname:?

@leeclemens
Copy link
Contributor

I think the email quantity topic is covered in Issue #832 Can this one be closed?

@szepeviktor
Copy link
Member Author

I am sorry. I can do only debugging in python. It would be nice to have less emails.

@kisst kisst mentioned this issue Aug 10, 2015
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@szepeviktor @leeclemens
0