I've recently started having problems with remote sites opening all available nodes, tying up my BBS. I have 12 nodes configured, and all 12 will be sitting at the login prompt and all from the same IP. I have been blocking entire blocks of IP addresses at my router, and more keep cropping up. Lately there have been 75 or 80 different addresses each day now. I have been blocking entire CIDR ranges after looking up the ASN and blocking all of their addresses.
Is there some way to prevent the same IP from connecting multiple times?
I've recently started having problems with remote sites opening all available nodes, tying up my BBS. I have 12 nodes configured, and all 12 will be sitting at the login prompt and all from the same IP. I have been blocking entire blocks of IP addresses at my router, and more keep cropping up. Lately there have been 75 or 80 different addresses each day now. I have been blocking entire CIDR ranges after looking up the ASN and blocking all of their addresses.
I've recently started having problems with remote sites opening all available nodes, tying up my BBS. I have 12 nodes configured, and all 12 will be sitting at the login prompt and all from the same IP. I have been blocking entire blocks of IP addresses at my router, and more keep cropping up. Lately there have been 75 or 80 different addresses each day now. I have been blocking entire CIDR ranges after looking up the ASN and blocking all of their addresses.
Denn wrote to Morpheus <=-
I've recently started having problems with remote sites opening all available nodes, tying up my BBS. I have 12 nodes configured, and all 12 will be sitting at the login prompt and all from the same IP. I have been blocking entire blocks of IP addresses at my router, and more keep cropping up. Lately there have been 75 or 80 different addresses each day now. I have been blocking entire CIDR ranges after looking up the ASN and blocking all of their addresses.
have you tried fail2ban?
Denn wrote to Morpheus <=-
I've recently started having problems with remote sites opening all available nodes, tying up my BBS. I have 12 nodes configured, and all 12 will be sitting at the login prompt and all from the same IP. I have been blocking entire blocks of IP addresses at my router, and more keep cropping up. Lately there have been 75 or 80 different addresses each day now. I have been blocking entire CIDR ranges after looking up the ASN and blocking all of their addresses.
have you tried fail2ban?
I have thought about trying fail2ban many times, but just haven't ever
had the need, although this recent bot crap is making me think about it again.
I'm in need of some info, which surprisingly can't seem to find good
answers for by searching. Here are a few questions I have if anyone
could answer them:
1. I understand it monitors log(s) and then adds lines/rules to
iptables to block/ban that IP address. But... what if you're not using iptables on the BBS computer? I'm not, because why would I be?
Digital Man wrote to Gamgee <=-
I have thought about trying fail2ban many times, but just haven't ever
had the need, although this recent bot crap is making me think about it again.
I'm in need of some info, which surprisingly can't seem to find good
answers for by searching. Here are a few questions I have if anyone
could answer them:
1. I understand it monitors log(s) and then adds lines/rules to
iptables to block/ban that IP address. But... what if you're not using iptables on the BBS computer? I'm not, because why would I be?
I'm not using it. When I have issues (on Vertrauen or reported) with
bots, I add features to Synchronet to mitigate those issues. I see
you're running a development build of Synchronet (v3.22a), so if you update to the latest, you should have this feature available in SCFG->Servers->Terminal Server:
.[=][?]================================.
I Max Concurrent Connections I }======================================{
I |Maximum (Unauthenticated) 2 I
I |Auto-Filter Threshold 10 I
I |Auto-Filter Duration 1 day I `======================================'
This feature has auto-banned 50 IP addresses on Vertrauen over the last
24 hours. Lower the threshold or increase the duration as you like.
have you tried fail2ban?
I have thought about trying fail2ban many times, but just haven't ever had the need, although this recent bot crap is making me think about it again.
So I'd be appreciative of a "Fail2ban for Dummies" type of setup guide, and especially on how to initially set up iptables for this use.
I have thought about trying fail2ban many times, but just haven't ever had the need, although this recent bot crap is making me think about it again.
I have used fail2ban in the past, I don't use it at this point as my router has built in DDOS protection and If you read the wiki it also gives a few tips to midigate attacks - https://wiki.synchro.net/howto:block-hackers
So I'd be appreciative of a "Fail2ban for Dummies" type of setup guide, and especially on how to initially set up iptables for this use.
https://www.youtube.com/watch?v=kmy8F5XTkoE
Are you using Debian or Ubuntu?
If all of your nodes are filled by the same IP, it sounds like you need to set your MaxConcurrentConnections to something way lower than it is.Thank you. I will give that a try.
In your sbbs.ini (in sbbs/ctrl), under the [BBS] section, try decreasing (or setting) the value of the MaxConcurrentConnections setting. I wasJust set it to 2 connections. I'll keep an eye on it and see how it goes.
have you tried fail2ban?No, haven't tried that yet.
| Sysop: | Amessyroom |
|---|---|
| Location: | Fayetteville, NC |
| Users: | 65 |
| Nodes: | 6 (2 / 4) |
| Uptime: | 26:28:37 |
| Calls: | 850 |
| Files: | 1,309 |
| D/L today: |
7 files (11,105K bytes) |
| Messages: | 273,998 |