Comments on: Protect Your Network from spamming, scanning, harvesting and dDoS attacks with DROP List

By: Christian

Christian — Wed, 14 Sep 2011 14:42:27 +0000

This script could be a little more secure. I.e. use a random tmp and clean up handler. Also the list processing can be done in bash (not awk needed.)

#!/bin/bash
URL="http://www.spamhaus.org/drop/drop.lasso"
drop=/tmp/drop.lasso.$$.$RANDOM
trap "rm -f $drop" EXIT
echo -n "Applying DROP list to existing firewall..."
wget -q -O $drop $URL
blocks=$(cat $drop | egrep -v '^;' | while read line ; do echo ${line%%;*} ; done)
...

By: Firas

Firas — Fri, 09 Apr 2010 12:23:09 +0000

Should we add the script in all our vps ? or just the node ?

By: Hamish

Hamish — Tue, 19 Feb 2008 11:17:34 +0000

It works well as a cron job, but you need to flush the old rules first. I added the following lines to the top of this script:
#!/bin/bash
iptables -F
./regular_rules
FILE=”/tmp/drop.lasso”
URL=”http://www.spamhaus.org/drop/drop.lasso”

Where regular_rules is a file containing all your standard iptables rules that you want to add the spamhaus rules to each day.

Not sure if i should stop and start the iptables service, i don’t currently, but i guess it’s an easy addition… Thanks for the script…

By: Me

Me — Thu, 31 Jan 2008 11:01:00 +0000

The script is problematic as a cron job.
It will create redundant drop rules, so every day
iptables will double its rules number.

Just run the script a few times and see.
1st run iptables rules count: 365
2nd run: 592
3rd run: 865

By: Ashi

Ashi — Fri, 11 Jan 2008 09:24:46 +0000

spamming is surely a threat to cyber space. most of the spammers are also hackers and they break into your pc as soon as you click on their email links. in order to fight the spam threat we need a strong spam filters for our emails which secures us from most of the spam mails. i have heard that http://www.zapak.com is one of the good e-mail service provider who gives maximum protection from most of the spam mails, now that is what we internet lovers require.

By: vivek

vivek — Wed, 05 Dec 2007 01:55:07 +0000

Joe,

This will only block bad guyes and not ssh, until and unless your IP is one of them ;)

By: Joe Klemmer

Joe Klemmer — Tue, 04 Dec 2007 23:58:55 +0000

I'm getting ready to try this out. There's one thing that's not clear to me, though. This article states specifically

you need to run on Linux based firewall / router / dedicated Linux web / mail server

My server is doing everything and it's brother. Is this going to affect all the other crap this box is doing (well, specifically ssh)?

By: vivek

vivek — Fri, 30 Nov 2007 14:49:20 +0000

Gregg,

thanks for sharing shorewall script.

By: Gregg Lain

Gregg Lain — Fri, 30 Nov 2007 12:34:44 +0000

Nice posting – expanded on the alternate route and since shorewall is running happily on my servers – why not let that “manage” the drops:

#!/bin/sh # # Drop all these bad IP's # TMPFILE=/tmp/`apg -a 1 -M nc -n 1 -m 26` touch $TMPFILE curl -s http://www.spamhaus.org/drop/drop.lasso |grep ^[1-9]|cut -f 1 -d ' ' > $TMPFILE for IP in `cat $TMPFILE`; do /sbin/shorewall drop $IP sleep 5 done rm $TMPFILE

The sleep statement helps the process from hogging all server resources….

Set this to run via cron twice daily – prefer to be a little paranoid in case of mid-day updates :)

By: Joe Klemmer

Joe Klemmer — Fri, 09 Nov 2007 23:25:31 +0000

Are there any metrics, empirical or subjective, measurements on the hit rate of false positives? I’d love to do more to keep the spam out.

By: vivek

vivek — Thu, 25 Oct 2007 12:25:28 +0000

Jerod,

You are dropping all incoming traffic from bad guys .

By: Jerod Santo

Jerod Santo — Wed, 24 Oct 2007 22:05:33 +0000

Correct me if I’m wrong, but doesn’t adding ip route network mask null0 only affect traffic leaving my network if said router is the gateway to my LAN?

If so, does that add much benefit?

By: vivek

vivek — Wed, 24 Oct 2007 18:11:21 +0000

Jerod,

Yes you need to update or add those ips to null0.

By: Jerod Santo

Jerod Santo — Wed, 24 Oct 2007 17:07:04 +0000

The script provided for Cisco devices simply updates a text file of the banned netblocks. Are we then supposed to use the cisco-cmd script to add the null routes to our cisco configs?