Very Computer

- this host try to open more than 10 connections in one hour to any available service.
- try to use pop-3/ftp and authentication fail more than 5 times.
- this host is source of icmp flooding/fragments
- use spoofed IP's
- try any other known-attack

Similar I would like that this host to be removed automatically after 1 to 7 days from the deny list.

Please help,

Thank you,

Chris

You are describing typical response requirements that can be initiated by Intrusion Detection Systems.
Commercial IDS systems (expensive) can provide a click and drag style for enforcing these rules but they
cost a lot.
Have a look at 'portsentry' instead. This tool can dynamically modify your firewall rules controlled by
the IPTABLES/IPCHAINS rules and when combined with a little bit of scripting (BASH, PERL) can do
wonders!

There are plenty of WWW documents that you could use as a starting point. Try
http://online.securityfocus.com/infocus/1580 for instance or have a look at the 'portsentry'
documentation.

Regards,

--
---

######################################
#       George B. Magklaras          #
#   Computer Systems Administrator   #
#               ----                 #
#  The Biotechnology Centre of Oslo  #
#           Gaustadalleen 21         #
#  P.O. BOX 1125, Blindern, N-0317   #
#            Oslo, Norway            #
#      Tel: +47 - 22 84 05 35        #
#      Fax: +47 - 22 84 05 01        #
######################################