[cobalt-users] Re: Blocking Access

[Bruce Timberlake <bruce@xxxxxxxxxx>]

Dan Kriwitsky wrote:
> > I'm getting port scans from this user 
> > "user-11fahma.dsl.mindspring.com", how do I go about blocking 
> > him and stop him from filling up my logs? Would I have to get 
> > his IP to add him to IPCHAINS?

> As root:
>
> /sbin/route add -host 66.245.70.202 reject

And you can get his IP by doing a

	traceroute user-11fahma.dsl.mindspring.com

or

	dig user-11fahma.dsl.mindspring.com in

and seeing what IP is returned.

If you have ipchains already set up, add this to your rule file:

-A input -s 66.245.70.202/255.255.255.255 -d 0.0.0.0/0.0.0.0 -i eth0 -j 
DENY -l

(above should all be one line)

Then reload ipchains.  If you use Dan's route method, make sure to put 
that command into one of your startup scripts someplace so that if your 
server reboots the host block will get added again.