[Snort-users] Rules to block FT

permalink · #1 (**permalink**) 06-27-2007

This is a multi-part message in MIME format.

--===============0506532881==
Content-class: urn:content-classes:message
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C7B8CE.79EEC675"

This is a multi-part message in MIME format.

------_=_NextPart_001_01C7B8CE.79EEC675
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

I have a testbed set up and have already alerted and blocked via
snortsam for SSH. I am now working on FTP.

=20

My rule:

=20

alert tcp $HOME_NET any -> $EXTERNAL_NET 21 ( msg:"BLOCKED Potential
FTP Brute-Force attempt";flow:from_server,established; content:"530 ";
pcre:"/^530\s+(Login|User|Failed)/smi";classtype:unsuccessful-user;
threshold: type threshold, track by_dst, count 10, seconds 60;
sid:1000002; rev:1; fwsam: src, 5 minutes;)

=20

Does this look like it will work? I am not that adept about building
rules and am learning. This was from bleeding edge, I think.

=20

Dwane

=20

------_=_NextPart_001_01C7B8CE.79EEC675
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:o=3D"urn:schemas-microsoft-com:office:office" =
xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns=3D"http://www.w3.org/TR/REC-html40">

<head>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 11 (filtered medium)">
<style>

</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

I have a testbed set up and have already alerted and =
blocked
via snortsam for SSH.  I am now working on =
FTP.<o:p></o:p>

<o:p> </o:p>

My rule:<o:p></o:p>

<o:p> </o:p>

alert tcp $HOME_NET any -> $EXTERNAL_NET 21 =
(  
msg:"BLOCKED Potential FTP Brute-Force
attempt";flow:from_server,established; content:"530 ";
pcre:"/^530\s+(Login|User|Failed)/smi";classtype:unsuccessful-u=
ser;
threshold: type threshold, track by_dst, count 10, seconds 60; =
sid:1000002;
rev:1; fwsam: src, 5 minutes;)<o:p></o:p>

<o:p> </o:p>

Does this look like it will work? I am not that adept =
about
building rules and am learning.  This was from bleeding edge, I =
think.<o:p></o:p>

<o:p> </o:p>

Dwane<o:p></o:p>

<o:p> </o:p>

</div>

</body>

</html>

------_=_NextPart_001_01C7B8CE.79EEC675--

--===============0506532881==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
--===============0506532881==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users
--===============0506532881==--

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode