peopleIPQ BDB filter - People at Savannah: View a Job

 
 

Requirements for the evaluation of packet filter effects for IPQ BDB filter

Category: Unix Admin
Submitter: ale2003
Date: Sat 31 Jul 2010 10:33:52 AM UTC
Status: Deleted

This group is not part of the GNU Project.

IPQ BDB filtering is done by a user space daemon that issues verdicts after looking up the IP address in a Berkeley DB. The fuzzy blocking model, freely inspired by STOCKADE, is designed to block dictionary attacks, but it can also mitigate compulsive spammers:


IPQ BDB requires you to devise and set up your firewall. That includes configuring regular expression, establishing probabilities and halving times, setting up iptables with NFQUEUE targets or nftables queue statements, as well as getting it all together in the boot sequence and cron jobs.  Thus, ipqbdb can be thought of as a building block for your firewall. Besides the daemon, and the log parser, this tiny package includes utilities to insert or delete IP addresses in a DB from the command line.

Although either iptables or nftables can be used —both rely on the same kernel facility (nfnetlink_queue)— the current version if ipqbdb can only filter IPv4 addresses.

As it requires Netfilter it is probably only usable under the Linux kernel 2.6.14 or later. In addition, it requires the following packages:


Similar projects: SSHGuard, Fail2ban, Fail2nft

License GNU General Public License v3 or later


Development Status
: 5 - Production/Stable

Details (job description, contact ...):

IPQ BDB is designed to be a lightweight packet filter that can operate on a large database.  It can drop and mark packets from IPv4 sources according to the data stored in the DB, and add, change or delete the data for each IP, after the remote host's behavior.  As it happens with possibly large amounts of data, it is difficult to evaluate the effects of those actions.  For example, users denying connections to a mail server after a host has sent to local spamtraps need to tune the number of messages that trigger the block and the duration of the block.

IPQ BDB currently has basic reporting capabilities.  It needs an expert Unix Admin who is able to specify what information is needed, and how to integrate it with other system data, in order to ease filter tuning and the evaluation of its effect.

Required Skills:

Skill Level Experience

(No skill inventory set up)

Back to the top

Powered by Savane 3.16-a7ba.
Corresponding source code