Re: [tlug] Script Kiddy Defence Script

[Shawn <bofh@example.com>]

On Thu, Jun 09, 2005 at 02:01:55PM +0200, Botond Botyanszki wrote:
> On Thu, 9 Jun 2005 18:39:00 +0900
> Shawn <bofh@example.com> wrote:
> 
> > On FreeBSD, you get a nightly security report mailed to you, which
> > reports failed login attempts. My cronned perl script scans those
> > emails and adds the relevant IPs to the firewall
> 
> by the time you add the deny rule to the firewall, your sandra user
> might be already running a zombie program communicating with a different
> host that you block...

Completely agreed. Its not meant to be an overall solution in and of itself. 
Its meant to be something that works in conjunction with other measures.

Shawn