OFFTOPIC: Svr getting hammered by hackers/IPBan/Upcloud

PointsWell

ACDC wrote
So it doesn't interact with any specific web server or ports.

I thought so, I get hundreds of attempts to hack into Tomcat. I have resorted to banning the IP address by manually changing the rules in the windows firewall on the Tomcat ports. But its a challenge you can imagine

It would be great if IP BAN could monitor the Tomcat logs in the same way it monitors the windows events and then based on some perceived bad behaviour in the log record set the firewall rules accordingly, It should be an easy plug-in feature upgrade.

I wonder if they would be open to adding this functionality.

It could even be a standalone utility that periodically imports the tomcat logs, makes an assessment of the suspect entries and then updates the windows firewall. A simple rule for me is ban ip address by country, this would get rid of most of the bad guys

If you setup a proxy forwarding web server (NGINX for example) in front of Tomcat you can use IPBan on port 80/443 ports and the aggressor never know that they are interrogating Tomcat.

ACDC

If you setup a proxy forwarding web server (NGINX for example) in front of Tomcat you can use IPBan on port 80/443 ports and the aggressor never know that they are interrogating Tomcat.

NGINX seems a nice option but it seems it doesn't run under windows, any other suggestion ?

PointsWell

ACDC wrote
If you setup a proxy forwarding web server (NGINX for example) in front of Tomcat you can use IPBan on port 80/443 ports and the aggressor never know that they are interrogating Tomcat.

NGINX seems a nice option but it seems it doesn't run under windows, any other suggestion ?

You'd run it as a Linux server in front of your windows box not on the same machine

« Previous Page