IPQ BDB filter - People at Savannah: View a Job
Requirements for the evaluation of packet filter effects for IPQ BDB filter
Category: Unix Admin
Submitter: ale2003
Date: Sat 31 Jul 2010 10:33:52 AM UTC
Status: Deleted
This group is not part of the GNU Project.
IPQ BDB filtering is done by a user space daemon that issues verdicts after looking up the IP address in a Berkeley DB. The fuzzy blocking model, freely inspired by STOCKADE, is designed to block dictionary attacks, but it can also mitigate compulsive spammers:
- The probability that an address will be blocked doubles every time it is caught red-handed, so as to reach 100% probability after the given number of times.
- Probabilities then decay automatically, so that all addresses are eventually rehabilitated without human intervention.
IPQ BDB requires you to devise and set up your firewall. That includes configuring regular expression, establishing probabilities and halving times, setting up iptables with NFQUEUE targets or nftables queue statements, as well as getting it all together in the boot sequence and cron jobs. Thus, ipqbdb can be thought of as a building block for your firewall. Besides the daemon, and the log parser, this tiny package includes utilities to insert or delete IP addresses in a DB from the command line.
Although either iptables or nftables can be used —both rely on the same kernel facility (nfnetlink_queue)— the current version if ipqbdb can only filter IPv4 addresses.
As it requires Netfilter it is probably only usable under the Linux kernel 2.6.14 or later. In addition, it requires the following packages:
- Berkeley DB
- PCRE
- Popt
- libcurl (optional for abuse reporting)
Similar projects: SSHGuard, Fail2ban, Fail2nft
License GNU General Public License v3 or later
Development Status: 5 - Production/Stable
Details (job description, contact ...):
IPQ BDB is designed to be a lightweight packet filter that can operate on a large database. It can drop and mark packets from IPv4 sources according to the data stored in the DB, and add, change or delete the data for each IP, after the remote host's behavior. As it happens with possibly large amounts of data, it is difficult to evaluate the effects of those actions. For example, users denying connections to a mail server after a host has sent to local spamtraps need to tune the number of messages that trigger the block and the duration of the block.
IPQ BDB currently has basic reporting capabilities. It needs an expert Unix Admin who is able to specify what information is needed, and how to integrate it with other system data, in order to ease filter tuning and the evaluation of its effect.
Required Skills:
| Skill | Level | Experience |
|---|---|---|
(No skill inventory set up) |
Powered by Savane 3.16-a7ba.
Corresponding source code
