MastodonTech.de

teufel100😈Nachdem das jetzt funktioniert, hat wer Interesse an dem <a href="https://social.guckt.info/tags/ossec" class="mention hashtag" rel="nofollow noopener" target="_blank">#OSSEC</a> Active-Response-Script, welches IPs auf eine Firewall-Blockliste schreibt und die dann auch an <a href="https://social.guckt.info/tags/abuseipdb" class="mention hashtag" rel="nofollow noopener" target="_blank">#AbuseIPDB</a> meldet? Ich müsste es zwar noch zu modifizieren, dass da keine Keys drin sind, aber ich könnte das schon veröffentlichen.

teufel100😈Cappuccino!<a href="https://social.guckt.info/tags/wiegehtesdir" class="mention hashtag" rel="nofollow noopener" target="_blank">#wiegehtesdir</a>Ich freue mich gerade, dass mein <a href="https://social.guckt.info/tags/ossec" class="mention hashtag" rel="nofollow noopener" target="_blank">#OSSEC</a> Active Response Script soweit funktioniert und jetzt die IPs, die geblockt werden, auch an <a href="https://social.guckt.info/tags/abuseipdb" class="mention hashtag" rel="nofollow noopener" target="_blank">#AbuseIPDB</a> sendet.In zwei Wochen darf ich einem Kunden auf seinen Windows10 Laptop Linux installieren, allerdings nur, wenn es wirklich kein Update auf Windows11 gibt. Als ich das letzte Mal geschaut hatte, war sein Laptop noch nicht supportet, vielleicht ist er es ja jetzt, ansonsten ist es dann ein Linux System ;).

teufel100😈So, mein <a href="https://social.guckt.info/tags/ossec" class="mention hashtag" rel="nofollow noopener" target="_blank">#OSSEC</a> Script sendet jetzt auch an <a href="https://social.guckt.info/tags/abuseipdb" class="mention hashtag" rel="nofollow noopener" target="_blank">#AbuseIPDB</a> ---> <a href="https://www.abuseipdb.com/user/234373" rel="nofollow noopener" target="_blank">https://www.abuseipdb.com/user/234373</a>

teufel100😈So, mal sehen, ob das so funktioniert, wie ich es mir vorstelle mit der Meldung bei <a href="https://social.guckt.info/tags/abuseipdb" class="mention hashtag" rel="nofollow noopener" target="_blank">#AbuseIPDB</a> über Ossec. Brauche jetzt nur ne Ossec-Meldung ;)

☮ ♥ ♬ 🧑‍💻> This IP address has been reported a total of 89 times from 60 distinct > sources. 129.159.93.171 was first reported on February 7th 2022, and the > most recent report was 9 hours agoCool, email spam dressed up as threats to life 🤣 <a href="https://ioc.exchange/tags/spam" class="mention hashtag" rel="nofollow noopener" target="_blank">#spam</a> / <a href="https://ioc.exchange/tags/Email" class="mention hashtag" rel="nofollow noopener" target="_blank">#Email</a> <a href="https://ioc.exchange/tags/EmailAbuse" class="mention hashtag" rel="nofollow noopener" target="_blank">#EmailAbuse</a> / <a href="https://ioc.exchange/tags/abuseipdb" class="mention hashtag" rel="nofollow noopener" target="_blank">#abuseipdb</a> <<a href="https://www.abuseipdb.com/check/129.159.93.171" rel="nofollow noopener" translate="no" target="_blank">https://www.abuseipdb.com/check/129.159.93.171</a>>

aaron ~# :blinkingcursor:I came across the <a href="https://infosec.exchange/tags/Fail2Ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fail2Ban</a> <a href="https://infosec.exchange/tags/docker" class="mention hashtag" rel="nofollow noopener" target="_blank">#docker</a> image from <a href="https://infosec.exchange/tags/linuxserverio" class="mention hashtag" rel="nofollow noopener" target="_blank">#linuxserverio</a> and thought to myself that it's finally time to set up Fail2Ban. I admit i never used it before and it was a bit difficult to add it to my <a href="https://infosec.exchange/tags/playbook" class="mention hashtag" rel="nofollow noopener" target="_blank">#playbook</a> as all of my <a href="https://infosec.exchange/tags/servers" class="mention hashtag" rel="nofollow noopener" target="_blank">#servers</a> have different services and therefore different <a href="https://infosec.exchange/tags/logfile" class="mention hashtag" rel="nofollow noopener" target="_blank">#logfile</a> paths, but that's nothing <a href="https://infosec.exchange/tags/jinja" class="mention hashtag" rel="nofollow noopener" target="_blank">#jinja</a> <a href="https://infosec.exchange/tags/templating" class="mention hashtag" rel="nofollow noopener" target="_blank">#templating</a> can't fix.Now that i've got <a href="https://infosec.exchange/tags/Discord" class="mention hashtag" rel="nofollow noopener" target="_blank">#Discord</a> notifications for banned <a href="https://infosec.exchange/tags/IPs" class="mention hashtag" rel="nofollow noopener" target="_blank">#IPs</a>, it's time to work on actual <a href="https://infosec.exchange/tags/IPblocking" class="mention hashtag" rel="nofollow noopener" target="_blank">#IPblocking</a>. I also want to use the <a href="https://infosec.exchange/tags/IPComplaint" class="mention hashtag" rel="nofollow noopener" target="_blank">#IPComplaint</a> and <a href="https://infosec.exchange/tags/AbuseIPDB" class="mention hashtag" rel="nofollow noopener" target="_blank">#AbuseIPDB</a> actions as i really like the idea of reporting abuse (even though i have no idea how effective that may be). I may also want to replace the discord <a href="https://infosec.exchange/tags/webhook" class="mention hashtag" rel="nofollow noopener" target="_blank">#webhook</a> with <a href="https://infosec.exchange/tags/email" class="mention hashtag" rel="nofollow noopener" target="_blank">#email</a> notifications later as that's mostly the reason i've set up a <a href="https://infosec.exchange/tags/mailserver" class="mention hashtag" rel="nofollow noopener" target="_blank">#mailserver</a> ( <a href="https://infosec.exchange/tags/stalwart" class="mention hashtag" rel="nofollow noopener" target="_blank">#stalwart</a> ) in the first place. I mean, most of my services are only accessible from <a href="https://infosec.exchange/tags/tailscale" class="mention hashtag" rel="nofollow noopener" target="_blank">#tailscale</a> or my <a href="https://infosec.exchange/tags/homenetwork" class="mention hashtag" rel="nofollow noopener" target="_blank">#homenetwork</a>, but since <a href="https://infosec.exchange/tags/Ansible" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ansible</a> makes it so much easier to apply higher standards, i just can't resist. My <a href="https://infosec.exchange/tags/homelab" class="mention hashtag" rel="nofollow noopener" target="_blank">#homelab</a> is changing every day and i think setting up additional <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a>, even though i don't need it yet, is never a bad idea. <a href="https://infosec.exchange/tags/networking" class="mention hashtag" rel="nofollow noopener" target="_blank">#networking</a> <a href="https://infosec.exchange/tags/badactors" class="mention hashtag" rel="nofollow noopener" target="_blank">#badactors</a> <a href="https://infosec.exchange/tags/firewall" class="mention hashtag" rel="nofollow noopener" target="_blank">#firewall</a> <a href="https://infosec.exchange/tags/automation" class="mention hashtag" rel="nofollow noopener" target="_blank">#automation</a> <a href="https://infosec.exchange/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#linux</a> <a href="https://infosec.exchange/tags/selfhosting" class="mention hashtag" rel="nofollow noopener" target="_blank">#selfhosting</a> <a href="https://infosec.exchange/tags/homeserver" class="mention hashtag" rel="nofollow noopener" target="_blank">#homeserver</a>

TealkIch finde es toll, dass das <a href="https://rollenspiel.social/tags/Fail2Ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fail2Ban</a> mittlerweile zuverlässig die IP's <a href="https://rollenspiel.social/tags/AbuseIPDB" class="mention hashtag" rel="nofollow noopener" target="_blank">#AbuseIPDB</a> meldet. Täglich um die 1000 Einträge laut API.<a href="https://www.abuseipdb.com/user/90603" rel="nofollow noopener" translate="no" target="_blank">https://www.abuseipdb.com/user/90603</a>Irgendwie wäre es noch toll wenn man das an alle möglichen Dienste z.B. <a href="https://rollenspiel.social/tags/Mastodon" class="mention hashtag" rel="nofollow noopener" target="_blank">#Mastodon</a> anbinden könnte, so dass Account's die von gemeldeten IP's erstellt werden, manuell geprüft werden müssen.

Schenkl | 🏳️‍🌈🦄Mir scheint, als würde gerade ein massiver <a href="https://chaos.social/tags/SSH" class="mention hashtag" rel="nofollow noopener" target="_blank">#SSH</a> <a href="https://chaos.social/tags/Brutefotce" class="mention hashtag" rel="nofollow noopener" target="_blank">#Brutefotce</a> Angriff auf <a href="https://chaos.social/tags/Hetzner" class="mention hashtag" rel="nofollow noopener" target="_blank">#Hetzner</a> IP Adressen zu laufen...Hab gestern mein 3000er <a href="https://chaos.social/tags/Ratelimit" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ratelimit</a> bei <a href="https://chaos.social/tags/abuseipdb" class="mention hashtag" rel="nofollow noopener" target="_blank">#abuseipdb</a> gerissen...In den Statistiken der letzten 28 Tage sehe ich einen stetigen Anstieg...<a href="https://chaos.social/tags/Fail2Ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fail2Ban</a> hat gut zu tun.Hat das sonst noch jemand bemerkt?

Rollenspiel MonsterIch habe <a href="https://rollenspiel.social/tags/Fail2Ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fail2Ban</a> ja so eingerichtet das es die Blocks an <a href="https://rollenspiel.social/tags/AbuseIPDB" class="mention hashtag" rel="nofollow noopener" target="_blank">#AbuseIPDB</a> sendet, krass wie viel da einfach nur bei rum kommt.

Schenkl | 🏳️‍🌈🦄Habe heute einige meiner <a href="https://chaos.social/tags/fail2ban" class="mention hashtag" rel="nofollow noopener" target="_blank">#fail2ban</a> sshd Jails meiner Server mal an die <a href="https://chaos.social/tags/abuseipdb" class="mention hashtag" rel="nofollow noopener" target="_blank">#abuseipdb</a> api hingestellt und die IP reporten lassen.In jetzt vielleicht 12 Stunden wurden über 1100 IPv4 Adressen reportet.Micht direkt als Webmaster freischalten zu lassen war ne gute Idee, sonst hätt ich das API Limit schon gerissen...Wird sicher noch mehr, wenn mal alle Server eingerichtet sind...

Frühere Suchanfragen

Suchoptionen

Verwaltet von:

Serverstatistik:

#abuseipdb