Show HN: No PortScan

#1

Post by jimsi » Wed, Nov 17, 2021, 1:08 PM UTC

Show HN: No PortScan
git.encryp.ch

Re: Show HN: No PortScan

#2

Post by hartator » Wed, Nov 17, 2021, 2:04 PM UTC

Not the subject of the thread but the GitHub clone used here seems pretty neat. Gitea. https://gitea.io/en-us/

What do you guys think about GitHub vs Gitlab vs Gitea? Kind of want to make me give a try.

Re: Show HN: No PortScan

#3

Post by DoubleFree » Wed, Nov 17, 2021, 2:35 PM UTC

hartator wrote: post #2

Not the subject of the thread but the GitHub clone used here seems pretty neat. Gitea. https://gitea.io/en-us/ What do you guys think about GitHub vs Gitlab vs Gitea? Kind of want to make me give a try.

I find the interface of GitHub (and therefore gitea) much more usable than gitlab's. Gitea is also easier and lighter to self-host than gitlab. Gitlab's CI offering is awesome though and really makes it stand out among software forges. Honorable mention towards sr.ht which is very appealing to me because of its lightweight design and usage of email for "PR's" and issues and soon IRC for chat.

Re: Show HN: No PortScan

#4

Post by tyingq » Wed, Nov 17, 2021, 2:37 PM UTC

"to check counters ratio in a background - if it exceeds some value (i.e. 1.5) we will execute user-defined action and reset counters for triggered IP"

Interesting approach, though it seems like it should have a "floor/minimum" count first. Otherwise, 2 syns, 1 syn-ack is 2:1. Fairly easy to trigger accidentally with bad timing.

Re: Show HN: No PortScan

#5

Post by sofixa » Wed, Nov 17, 2021, 2:41 PM UTC

hartator wrote: post #2

Not the subject of the thread but the GitHub clone used here seems pretty neat. Gitea. https://gitea.io/en-us/ What do you guys think about GitHub vs Gitlab vs Gitea? Kind of want to make me give a try.

Gitea is a perfectly fine lightweight Git hosting platform. However you need external CI/CD, project management and what not; with GitLab that and a lot of other things come included.

So, it will depend on what you need.

Re: Show HN: No PortScan

#6

Post by majou » Wed, Nov 17, 2021, 3:04 PM UTC

hartator wrote: post #2

Not the subject of the thread but the GitHub clone used here seems pretty neat. Gitea. https://gitea.io/en-us/ What do you guys think about GitHub vs Gitlab vs Gitea? Kind of want to make me give a try.

Gitea is cozy, I like to s/Organization/Folder/ in the html templates.

Re: Show HN: No PortScan

#7

Post by remram » Wed, Nov 17, 2021, 3:31 PM UTC

sofixa wrote: post #5

hartator wrote: post #2

Not the subject of the thread but the GitHub clone used here seems pretty neat. Gitea. https://gitea.io/en-us/ What do you guys think about GitHub vs Gitlab vs Gitea? Kind of want to make me give a try.

Gitea is a perfectly fine lightweight Git hosting platform. However you need external CI/CD, project management and what not; with GitLab that and a lot of other things come included. So, it will depend on what you need.

How hard is it to set up CI? I know there are open-source CI solutions (Drone, SourceHut) but I don't know how hard they are to install and connect to Gitea. I don't think I'd use a platform with no CI.

Re: Show HN: No PortScan

#8

Post by sofixa » Wed, Nov 17, 2021, 3:40 PM UTC

remram wrote: post #7

sofixa wrote: post #5

Earlier quoted context omitted.

Gitea is a perfectly fine lightweight Git hosting platform. However you need external CI/CD, project management and what not; with GitLab that and a lot of other things come included. So, it will depend on what you need.

How hard is it to set up CI? I know there are open-source CI solutions (Drone, SourceHut) but I don't know how hard they are to install and connect to Gitea. I don't think I'd use a platform with no CI.

Drone ( the only standalone non-SaaS CI system I've used) was easy to install and connect ( it was a matter of 3-4 config options, and a single auth/app creation flow).

Re: Show HN: No PortScan

#9

Post by jimsi » Wed, Nov 17, 2021, 3:48 PM UTC

tyingq wrote: post #4

"to check counters ratio in a background - if it exceeds some value (i.e. 1.5) we will execute user-defined action and reset counters for triggered IP" Interesting approach, though it seems like it should have a "floor/minimum" count first. Otherwise, 2 syns, 1 syn-ack is 2:1. Fairly easy to trigger accidentally with bad timing.

This ratio is only applied if there are more than 1000 SYNs, forgot to mention that in the README (https://git.encryp.ch/g00g1/no-portscan/src/branch/master/cm...)

Re: Show HN: No PortScan

#10

Post by mmh0000 » Wed, Nov 17, 2021, 4:11 PM UTC

Something like this can be implemented in Linux's NetFilter quite easily using the recent module:

    iptables -A FORWARD -i eth0 -m recent --update --seconds 600 --hitcount 10 --name scan --mask 255.255.255.255 --rsource -j DROP
    iptables -A FORWARD -d 173.165.141.72/29 -i vmexfwbr -m recent --update --seconds 86400 --name instaban --mask 255.255.255.255 --rsource -j DROP
    …PUT STANDARD ACCEPT/REJECT RULES HERE…
    iptables -A FORWARD -d 173.165.141.72/29 -i vmexfwbr -p tcp -m multiport --dports 21,23,110,1433,3389,5060,8080,8088 -m recent --mask 255.255.255.0 --set --name instaban --rsource -m comment --comment "Instabans port scanning bots."
    iptables -A FORWARD -d $YOUR_IP_RANGE/29 -i eth0 -m recent --mask 255.255.255.0 --set --name scan --rsource
    iptables -A FORWARD -j REJECT --reject-with icmp-port-unreachable

The above would start dropping packets from anyone who hits 10 or more ports not previously accepted by an accept rule, and block the /24 of anyone who hits one of the more commonly scanned ports.