+the Scanner Tarpit HOWTOK

John D. Hardin [lt    ]jhardin@impsec.org[gt    ] 
 $Revision: 0.15 $ $Date: 2006-12-15 21:03:16-08 $

How to configure a Linux firewall protecting a publicly-accessible (boundary, DMZ) network to detect worms' and attackers' scanning activity and react in real time to block and interfere with that scanning activity. A discussion of reporting tools and possible extensions is also included, with details for setting up an SMTP-only tarpit.

· 1 Introduction
· 1.1 Introduction 
· 1.2 Audience
· 1.3 Tools 
· 1.4 Feedback, Credits [amp   ] Resources
· 1.5 Copyright [amp   ] Disclaimer
· 2 Background Knowledge
· 2.1 What is a firewall?
· 2.2 What is a Boundary Network or DMZ?
· 2.3 What is a firewall script?
· 2.4 What is a tarpit?
· 2.5 What is Transparent Proxy?
· 3 Planning
· 3.1 Traffic that is always hostile
· 3.2 Traffic to nonexistent hosts
· 4 Detecting and blocking scans of the boundary network
· 4.1 Configuring Portsentry
· 4.2 The i-i-blk and o-i-blk firewall chains
· 5 Tarpitting the scanner or worm
· 5.1 Running LaBrea on the outer firewall
· 6 Reporting scanning activity
· 6.1 LogCheck - notify yourself
· 6.2 DShield - notify the ISP and others
· 6.3 MRTG - graph the activity
· 7 Protecting individual computers
· 8 Possible extensions
· 8.1 Spam control