Greylisting and a new approach ?

[uxbod]

Recently I have been introduced to Welcome to the Home of OSSEC (which is a great tool) and thought about a different use for it. It already has a decoder/ruleset for Postfix so instead of issuing a iptables block from a command action why not inject the source IP address into a greylisting table ossec already has its own timeout capability which could be used to delete the entry after a pre-determined time.

Thoughts ?

[dave_kempe]

If you are concerned about a host to use OSSEC, then maybe iptables is a better approach. greylisting is not like the same door-slamming effect of simply dropping traffic from a suspect host.

[uxbod]

Thanks for the response. I do not wish to "slam the door" but temporarily stem the inbound traffic from a bot or rooted server. I could just run a greyserver and let that apply the rules to all inbound traffic; though I have been burnt by that before. By using the method I have indicated it would only apply greylisting to specific inbound servers. Perhaps apply a 450 for 5 minutes, but keep a track of the IP, and if they connect again within a certain time period steadily increase the greylisting time.