Announcement

Collapse
No announcement yet.

Ban an IP

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Ban an IP

    Hello,

    In the log I see this, a lot of time :

    **** ALERT **** 67.152.208.130 gave false logon/password to POP server; user: [email protected] [EvSecurity]

    Is there a way to block (ban) a specific IP for all protocol ?

    Regards,

  • #2
    Re: Ban an IP

    sure, on you're firewall?
    Marcel
    Technical Consultant
    Netherlands
    http://www.phetios.com
    http://blog.nessus.nl

    MCITP(EA, SA), MCSA/E 2003:Security, CCNA, SNAF, DCUCI, CCSA/E/E+ (R60), VCP4/5, NCDA, NCIE - SAN, NCIE - BR, EMCPE
    "No matter how secure, there is always the human factor."

    "Enjoy life today, tomorrow may never come."
    "If you're going through hell, keep going. ~Winston Churchill"

    Comment


    • #3
      Re: Ban an IP

      Originally posted by Dumber View Post
      sure, on you're firewall?
      Well, could you tell me the right think to do, because my server is in an another country and I'd like not do any mistake ....

      Regards,

      Comment


      • #4
        Re: Ban an IP

        What firewall are you using?
        Marcel
        Technical Consultant
        Netherlands
        http://www.phetios.com
        http://blog.nessus.nl

        MCITP(EA, SA), MCSA/E 2003:Security, CCNA, SNAF, DCUCI, CCSA/E/E+ (R60), VCP4/5, NCDA, NCIE - SAN, NCIE - BR, EMCPE
        "No matter how secure, there is always the human factor."

        "Enjoy life today, tomorrow may never come."
        "If you're going through hell, keep going. ~Winston Churchill"

        Comment


        • #5
          Re: Ban an IP

          Originally posted by Dumber View Post
          What firewall are you using?
          Windows Firewall

          Comment


          • #6
            Re: Ban an IP

            Sorry???
            I really hope you didn't put a Windows 2003 server live on the internet with only the Windows firewall enabled.

            You might have a look at this: http://forums.webhostautomation.com/...ead.php?t=2906
            However, I'm not responible if something goes wrong...
            Marcel
            Technical Consultant
            Netherlands
            http://www.phetios.com
            http://blog.nessus.nl

            MCITP(EA, SA), MCSA/E 2003:Security, CCNA, SNAF, DCUCI, CCSA/E/E+ (R60), VCP4/5, NCDA, NCIE - SAN, NCIE - BR, EMCPE
            "No matter how secure, there is always the human factor."

            "Enjoy life today, tomorrow may never come."
            "If you're going through hell, keep going. ~Winston Churchill"

            Comment


            • #7
              Re: Ban an IP

              Originally posted by Dumber View Post
              Sorry???
              I really hope you didn't put a Windows 2003 server live on the internet with only the Windows firewall enabled
              Why not ? Other solution ?

              Comment


              • #8
                Re: Ban an IP

                There are plenty of other firewall solutions which are way better then the Windows firewall. For example ISA server, Check Point, cisco ASA etc.
                Marcel
                Technical Consultant
                Netherlands
                http://www.phetios.com
                http://blog.nessus.nl

                MCITP(EA, SA), MCSA/E 2003:Security, CCNA, SNAF, DCUCI, CCSA/E/E+ (R60), VCP4/5, NCDA, NCIE - SAN, NCIE - BR, EMCPE
                "No matter how secure, there is always the human factor."

                "Enjoy life today, tomorrow may never come."
                "If you're going through hell, keep going. ~Winston Churchill"

                Comment


                • #9
                  Re: Ban an IP

                  TBH if you don't have physical access to this server I wouldn't recommend installing another software firewall. You'll only end up finding that you've closed all remote access on yourself.

                  A hardware firewall would be better but imo the Windows Firewall do enough as long as it is configured correctly.

                  One incorrect login attempt shouldn't be a problem though. Is this IP trying multiple times?
                  Please remember to leave positive reputation points (The Ying Yang Icon) if someone helps you.

                  Comment


                  • #10
                    Re: Ban an IP

                    it's generally a bad practice to install any kind of windows with no proper protection from the internet. exchange especially.
                    consider using a front/back-end technology, preferrably NOT using windows on the frontend.

                    after that, a great package called fail2ban can be applied with any set of rules, including banning IPs after a few failed attempts
                    ________
                    Lincoln continental mark vii specifications
                    Last edited by DYasny; 6th March 2011, 18:18.
                    Real stupidity always beats Artificial Intelligence (c) Terry Pratchett

                    BA (BM), RHCE, MCSE, DCSE, Linux+, Network+

                    Comment

                    Working...
                    X