Re: [cobalt-security] consistently pounded

[Brent Sims <brent@xxxxxxxxxxx>]

On Tue, 23 May 2000, Theodore Jones so wrote:

} So why isn't there a siimple way to have a script watch the error log report
} and just add certain IP numbers to the hosts.deny file...?

	I have not actually looked at the configuration file but tcp
wrappers does not watch the httpd port by default.

} > I would strongly discourage tcp wrappers on the http port. You will get a
} > huge performance hit.  one of the ways that a web server an be so fast is
} > because it has several daemons running and waiting for connections.

	While the performance hit is indeed correct, the attack, as
I understand things, exists in real time. Thus the choice is to sit
back and watch hoping for the best, or to take some form of
proactive action. 

	Peace be with you,
	
	Brent
	
	Brent Sims
	WebOkay Internet Services
	http://www.WebOkay.net
	Brent@xxxxxxxxxxx
	(719) 595-1427 (Voice/Fax)