0

Watching requests log, I see some IPs, considered Black List.

For example:

91.224.217.74 - - [06/Dec/2017:11:12:54 +0000] "GET / HTTP/1.1" 200 10951 "-" "curl/7.17.1 (mips-unknown-linux-gnu) libcurl/7.17.1 OpenSSL/0.9.8i zlib/1.2.3"

I am using ufw to firewall.

My question is if there is a way or tool for Debian, to automatically check a IP reputation source and automatically add rules to ban that type requests?

  • There is a good bash script on Github which seems to me ok for what you are looking for. It can be customizable in terms of blacklist (you can add IPs or remove from its db). Link: github.com/trick77/ipset-blacklist .Also, you may want to look at this(xmodulo.com/block-unwanted-ip-addresses-linux.html) ,too. By the way, before asking question please (at least) search on the internet. – JackSparrow Dec 6 '17 at 14:13
  • @JackSparrow tks for atention, sry about question is not my best i can try be better on next, but im new in Information Security... – MagicHat Dec 6 '17 at 14:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.