OT: Server protection strategy from evil doers - how to stop them.
Good day.
My question is about the strategy practice of stopping the evil doers at my
server - as it is a server I can not turn it off, yet I would not that the
things that some guys try to do will be repeated. Therefore, may, You would
share Your experience/knowledge how to stop them.
The situation: I see evil doing in logs. I know the addresses they did use for
that.
What is the best way (1. Effective; 2. Easy to commit) to stop them?
My own considerations for now: to use iptables to ban those IPs, but here I
have the following problem: if I exclude by IP - it is a lot of IPs. If I
exclude by its ranges - I risk to exclude goo users from our public services
(web, email) others - the same is for the ISP nets - as their users can change
their IPs easily. So... please, any suggestions.
Thank You for Your time and effort.
Best regards,
Sthu Deus.
Reply to: