mainIPQ BDB filter - Summary

 
 
Membership Info
Project Admin:
1 active member

Group identification
Id: #10071
System Name: ipqbdb
Name: IPQ BDB filter
Group Type: non-GNU software and documentation

Search in this Group

in
   

This project is not part of the GNU Project.

IPQ BDB filtering is done by a user space daemon that issues verdicts after looking up the IP address in a Berkeley DB. The fuzzy blocking model, freely inspired by STOCKADE, is designed to block non-distributed dictionary attacks:

  • The probability that an address will be blocked doubles every time it is caught red-handed, so as to reach 100% probability after the given number of times.
  • Probabilities then decay automatically, so that all addresses are eventually rehabilitated without human intervention.

IPQ BDB filter may be considered as a fail2ban lite: it is fast C code, it does not alter iptables, but rather requires you to devise and set up your firewall. In the latter respect, it can be thought of as a building block for such task. Besides the daemon, this tiny package includes utilities to insert IP addresses in a DB from the command line, parsing log files, deleting and listing records in a DB.

As it requires Netfilter it is probably only usable under the Linux kernel 2.6.14 or later. In addition, it requires the following packages:

Registration Date: Sat 15 Nov 2008 12:10:32 PM UTC
License: GNU General Public License v3 or later
Development Status: 3 - Alpha

 

Latest News 
Released v1.04
     posted by ale2003, Thu 12 Sep 2013 03:58:27 PM UTC - 0 replies

Maintenance release enabling BDB version 5.*, and minor changes including:

  • Man pages for ibd-del, ibd-ban, and ibd-white. More man pages will be added soon.
  • Allow multiple addresses to be passed in a single ibd-ban command.
  • Accept IPv4 mapped IPv6 addresses. (These tools will only store IPv4 addresses until I get a real IPv6 host address to experiment with.)
  • Decay treatment tweaks: Default value changed from 2 mins to 6 hours, and decay doubled on passing the threshold.
Released v1.03
     posted by ale2003, Thu 10 Mar 2011 06:44:09 PM UTC - 0 replies

Changes and new features:

  • New option --exec-connkill (-e for short) in ibd-ban and ibd-parse. Detailed below.
  • ibd-config displays the new configuration file, and also the maximum initial-count that the architecture supports.
  • New ...

[Read more]
Use libnetfilter_queue 0.0.17 or better
     posted by ale2003, Fri 30 Jul 2010 06:37:55 PM UTC - 0 replies

After some months, it seems linking with the newer version of libnetfilter_queue fixes the behavior when a queue error is experienced. Ipqbdb v1.02 logs such error and continues to run smoothly. That error --recv() returning -1 retrieving a message from the queue-- happens very seldom and is still being investigated. ...


[Read more]
Version 1.0 on 24 Jan 2010
     posted by ale2003, Sun 24 Jan 2010 06:46:53 PM UTC - 0 replies

In the new version I've renamed the ipqbdbd daemon to ibd-judge, as it emits verdicts. That way it's easier to grep logs or processes. New features are

  • terminate established connections by letting iptables send tcp-reset to the local server for packets marked guilty,
  • specify the target database size when deleting old records, and
  • collect statistics.

[Submit News]
[5 news in archive]

Communication Tools
Mailing Lists Mailing Lists (1 public mailing-list)

Back to the top


Powered by Savane 3.1-cleanup