{"id":923,"date":"2017-04-20T21:16:59","date_gmt":"2017-04-21T01:16:59","guid":{"rendered":"http:\/\/www.rfdm.com\/blog\/?p=923"},"modified":"2017-04-26T22:01:59","modified_gmt":"2017-04-27T02:01:59","slug":"more-on-mcblockd-automation-progress","status":"publish","type":"post","link":"https:\/\/www.rfdm.com\/blog\/?p=923","title":{"rendered":"more on mcblockd automation progress"},"content":{"rendered":"

Similar to what I have for sshd, I have real time log processing on my web server. The secure remote communication with mcblockd<\/tt> is very nice to have, since my web server is a separate machine from my gateway\/firewall. Below you can see offending web server log entries followed immediately by an action from mcblockd<\/tt>. Instant blocking, without my involvement.<\/p>\n

\r\n185.36.102.114 - [20\/Apr\/2017:19:08:08] \"GET \/blog\/xmlrpc.php HTTP\/1.0\" 200 42\r\nApr 20 19:08:09 ria mcblockd: [I] Added 185.36.100\/22 (CZ) to www_losers for 30 days\r\n\r\n191.101.117.226 - [20\/Apr\/2017:19:57:52] \"POST \/blog\/xmlrpc.php HTTP\/1.1\" 500 -\r\nApr 20 19:57:52 ria mcblockd: [I] Added 191.101\/16 (CL) to www_losers for 90 days\r\n\r\n5.164.231.83 - [20\/Apr\/2017:20:12:07] \"GET \/blog\/xmlrpc.php HTTP\/1.0\" 200 42\r\nApr 20 20:12:08 ria mcblockd: [I] Added 5.164\/14 (RU) to www_losers for 90 days\r\n\r\n160.202.162.204 - [22\/Apr\/2017:21:59:24] \"GET \/wp-login.php HTTP\/1.1\" 404 210\r\nApr 22 21:59:24 ria mcblockd: [I] Added 160.202.160\/22 (KR) to www_losers for 90 days\r\n\r\n104.173.193.176 - [23\/Apr\/2017:00:58:00] \"GET \/wp-login.php HTTP\/1.1\" 404 210\r\nApr 23 00:58:00 ria mcblockd: [I] Added 104.173.193\/24 (US) to www_losers for 30 days\r\n\r\n191.37.7.186 - [23\/Apr\/2017:04:18:19] \"GET \/wp-login.php HTTP\/1.1\" 404 210\r\nApr 23 04:18:19 ria mcblockd: [I] Added 191.37.0\/17 (BR) to www_losers for 90 days\r\n\r\n103.229.124.123 - [23\/Apr\/2017:07:50:15] \"GET \/xmlrpc.php HTTP\/1.1\" 404 208\r\nApr 23 07:50:15 ria mcblockd: [I] Added 103.229.124\/22 (TW) to www_losers for 30 days\r\n\r\n61.77.12.200 - [23\/Apr\/2017:09:40:35] \"GET \/wp-login.php HTTP\/1.1\" 404 210\r\nApr 23 09:40:36 ria mcblockd: [I] Added 61.72\/13 (KR) to www_losers for 90 days\r\n\r\n46.161.9.14 - [23\/Apr\/2017:10:30:24] \"GET \/blog\/xmlrpc.php HTTP\/1.0\" 405 42\r\nApr 23 10:30:24 ria mcblockd: [I] Added 46.161.0\/18 (RU) to www_losers for 90 days\r\n\r\n<\/pre>\n
And yes, the threshold policy code works fine.  Below is the result of someone trying to log in 5 times over a period of about 26 minutes.  Since I have the threshold set to 5 times in 30 days, they were way above the threshold, but this would be considered a ‘slow’ attempt by some measures.<\/p>\n
\r\nApr 21 17:08:59 ria mcblockd: [I] Pending 69.162.73\/24 (US) for ssh_losers, 1\/5\r\nApr 21 17:08:59 ria mcblockd: [I] Pending 69.162.73\/24 (US) for ssh_losers, 2\/5\r\nApr 21 17:22:14 ria mcblockd: [I] Pending 69.162.73\/24 (US) for ssh_losers, 3\/5\r\nApr 21 17:22:14 ria mcblockd: [I] Pending 69.162.73\/24 (US) for ssh_losers, 4\/5\r\nApr 21 17:35:21 ria mcblockd: [I] Added 69.162.73\/24 (US) to ssh_losers for 30 days\r\n<\/pre>\n
And another over a period of about 91 minutes:<\/p>\n
\r\nApr 23 01:39:43 ria mcblockd: [I] Pending 64.179.211\/24 (CA) for ssh_losers, 1\/5\r\nApr 23 01:39:43 ria mcblockd: [I] Pending 64.179.211\/24 (CA) for ssh_losers, 2\/5\r\nApr 23 02:25:48 ria mcblockd: [I] Pending 64.179.211\/24 (CA) for ssh_losers, 3\/5\r\nApr 23 02:25:48 ria mcblockd: [I] Pending 64.179.211\/24 (CA) for ssh_losers, 4\/5\r\nApr 23 03:11:15 ria mcblockd: [I] Added 64.179.211\/24 (CA) to ssh_losers for 30 days\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"
Similar to what I have for sshd, I have real time log processing on my web server. The secure remote communication with mcblockd is very nice to have, since my web server is a separate machine from my gateway\/firewall. Below you can see offending web server log entries followed immediately by an action from mcblockd. … <\/p>\n
Continue reading “more on mcblockd automation progress”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[29,85,12],"tags":[],"class_list":["post-923","post","type-post","status-publish","format-standard","hentry","category-freebsd","category-network-security","category-software-development"],"_links":{"self":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/923","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=923"}],"version-history":[{"count":13,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/923\/revisions"}],"predecessor-version":[{"id":936,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/923\/revisions\/936"}],"wp:attachment":[{"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=923"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=923"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rfdm.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=923"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}