RE: Scriptable defense question

[<David_Falloon () kaltire com>]

You could also use OSSEC ( www.ossec.net ).

--D


> -----Original Message-----
> From: listbounce () securityfocus com 
> [mailto:listbounce () securityfocus com] On Behalf Of scott
> Sent: Thursday, May 14, 2009 1:08 PM
> To: pen-test () securityfocus com
> Subject: Re: Scriptable defense question
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Christian Eric Edjenguele wrote:
> > if you are able to parse the log, if your loggin in xml for example 
> > you can use a sax parser or whatever you prefer, then call 
> iptables to 
> > filter connection to the host. iptables is powerful and 
> very scriptable.
> > cheers
> >
> > Fred H wrote:
> > > Hi All,
> > >
> > > here is a scenario that has come up.
> > > Lets says there is a generic server that is on a dmz, and 
> there are 
> > > many password attempts on the server.  Is there a tool that would 
> > > allow for a tcp reset, or connection drop , or possible bar future 
> > > sessions from that IP?
> > > I am thinking of a script that parses a log, looks for repeated 
> > > attempts from the same IP, and then calls a tool that drops the 
> > > connection.
> > >
> > > Does anyone have any ideas on this?
> > >  Fred Hamilton
> > > Information Security Analyst 2
> > > Financial Sector
> > >
> > >
> > >
> > >      
> ---------------------------------------------------------------------
> > > --- This list is sponsored by: Information Assurance Certification 
> > > Review Board
> > >
> > > Prove to peers and potential employers without a doubt 
> that you can 
> > > actually do a proper penetration test. IACRB CPT and CEPT certs 
> > > require a full practical examination in order to become certified.
> > > http://www.iacertification.org
> ---------------------------------------------------------------------
> > > ---
>
> If you are running a *nix, try psad.
>
> Scott
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iEYEARECAAYFAkoMeicACgkQFQICCHwe04JqaACguxQ5ILHAY5gXJ2dFoF5ixfqn
> 1ZAAniJaJR4btp7WKmnh5fSGpT5axqOn
> =5YYe
> -----END PGP SIGNATURE-----
>
> --------------------------------------------------------------
> ----------
> This list is sponsored by: Information Assurance 
> Certification Review Board
>
> Prove to peers and potential employers without a doubt that 
> you can actually do a proper penetration test. IACRB CPT and 
> CEPT certs require a full practical examination in order to 
> become certified. 
>
> http://www.iacertification.org
> --------------------------------------------------------------
> ----------

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------