IPQ BDB filter - Summary
This project is not part of the GNU Project.
IPQ BDB filtering is done by a user space daemon that issues verdicts after looking up the IP address in a Berkeley DB. The fuzzy blocking model, freely inspired by STOCKADE, is designed to block non-distributed dictionary attacks:
- The probability that an address will be blocked doubles every time it is caught red-handed, so as to reach 100% probability after the given number of times.
- Probabilities then decay automatically, so that all addresses are eventually rehabilitated without human intervention.
IPQ BDB filter may be considered as a fail2ban lite: it is fast C code, it does not alter iptables, but rather requires you to devise and set up your firewall. In the latter respect, it can be thought of as a building block for such task. Besides the daemon, this tiny package includes utilities to insert IP addresses in a DB from the command line, parsing log files, deleting and listing records in a DB.
As it requires Netfilter it is probably only usable under the Linux kernel 2.6.14 or later. In addition, it requires the following packages:
Registration Date: Sat 15 Nov 2008 12:10:32 PM UTC
License: GNU General Public License v3 or later
Development Status: 3 - Alpha
posted by ale2003, Thu 10 Mar 2011 06:44:09 PM UTC - 0 replies
Changes and new features:
- New option --exec-connkill (-e for short) in ibd-ban and ibd-parse. Detailed below.
- ibd-config displays the new configuration file, and also the maximum initial-count that the architecture supports.
- New ...
[Read more]
posted by ale2003, Fri 30 Jul 2010 06:37:55 PM UTC - 0 replies
After some months, it seems linking with the newer version of libnetfilter_queue fixes the behavior when a queue error is experienced. Ipqbdb v1.02 logs such error and continues to run smoothly. That error --recv() returning -1 retrieving a message from the queue-- happens very seldom and is still being investigated.
...
[Read more]
posted by ale2003, Sun 24 Jan 2010 06:46:53 PM UTC - 0 replies
In the new version I've renamed the ipqbdbd daemon to ibd-judge, as it emits verdicts. That way it's easier to grep logs or processes. New features are
- terminate established connections by letting iptables send tcp-reset to the local server for packets marked guilty,
- specify the target database size when deleting old records, and
- collect statistics.
posted by ale2003, Tue 23 Dec 2008 04:59:10 PM UTC - 0 replies
The 0.1 release has been running smoothly on a 64bit Intel debian system since December 16, 2008. It has a unique queue. Parsing consumes much more than actual filtering.
It did catch the lame dictionary attack that it has been designed to block!
...
[Read more]
[Submit News]
[4 news in archive]



