Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #3052

Re: Blocking IP addresses from specific countries

Show all headers | View raw

On Mon, 28 Jul 2014 17:51:35 +0000, Moe Trin wrote:
> On Mon, 28 Jul 2014, in the Usenet newsgroup comp.os.linux.networking,
> in article <lr5ih0$g6$1@dont-email.me>, Joe Beanfish wrote:
> 
>>If you want to do gross blocking by continent (roughly)
> 
> LARGE pinch of salt needed with that ;-)
> 
>>you could use the list at
>>http://www.iana.org/assignments/ipv4-address-space/ipv4-address-
>>space.xhtml . Also available as csv or xml.
> 
> and even raw (readable) text
> 
>>e.g.: for my personal use server I block all of APNIC, RIPE, AFRINIC,
>>LACNIC, etc. since I'm not a globetrotter.
> 
> Point your news-reader at the "comp.risks" newsgroup, and view the issue
> of Friday 25 July 2014 (subject line "Risks Digest 28.10").
> Read the items "How Hackers Hid a Money-Mining Botnet in Amazon's
> Cloud".  Then tell me what country Amazon, Google, Heroku, Cloud
> Foundry, CloudBees and other cloud server networks are "from".  I
> suppose that also applies to 0wn3d windoze boxes on most cable/DSL
> networks.
> 
> I prefer to set the firewall to ACCEPT connections from specific network
> ranges for specific ports, and REJECT all other connection attempts with
> the default rules.    If you really need to allow SSH access from "the
> world", you can look at a log-reader tool such as "BlockHosts",
> "Fail2Ban", "blocksshd" or "BruteForceBlocker", to TEMPORARILY block (10
...

Certainly. Good security is a multi-faceted and layered system. Blocking
huge swaths of the net you know you won't use greatly diminishes your
vulnerability footprint. Doing so dramatically reduced attack attempts
seen by other tools down the line. But, as you say, this is only one
facet. Anyone that claims that "this one thing", whatever it is, is "the
way to be secure" doesn't know what they're talking about.

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Blocking IP addresses from specific countries Clark Smith <noaddress@nowhere.net> - 2014-07-27 20:14 +0000
  Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-28 02:32 +0000
  Re: Blocking IP addresses from specific countries Jorgen Grahn <grahn+nntp@snipabacken.se> - 2014-07-28 07:13 +0000
  Re: Blocking IP addresses from specific countries Andrzej Adam Filip <anfi@onet.eu> - 2014-07-28 09:17 +0200
  Re: Blocking IP addresses from specific countries Joe Beanfish <joebeanfish@nospam.duh> - 2014-07-28 13:17 +0000
    Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-28 17:51 +0000
      Re: Blocking IP addresses from specific countries Aleksandar Kuktin <akuktin@gmail.com> - 2014-07-28 19:36 +0000
        Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-29 01:59 +0000
      Re: Blocking IP addresses from specific countries Keith Keller <kkeller-usenet@wombat.san-francisco.ca.us> - 2014-07-28 14:23 -0700
        Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-29 01:57 +0000
      Re: Blocking IP addresses from specific countries Joe Beanfish <joebeanfish@nospam.duh> - 2014-07-29 13:16 +0000
  Re: Blocking IP addresses from specific countries Roger Blake <rogblake@iname.invalid> - 2014-07-28 20:55 +0000
    Re: Blocking IP addresses from specific countries Moe Trin <ibuprofin@painkiller.example.tld.invalid> - 2014-07-29 02:00 +0000

csiph-web