My friend Shadd gave me a
list of URLs that I should try to block so that I could allow comments back on this blog. Back in November, my site was down because I was getting spammed like crazy. I'm not sure this is the best approach, because I don't want to alienate half the world from my site. But its worth a shot. Also, with all this talk about North Korean hackers and stuff, we could all revisit our security settings to see how we're doing.
These commands work on CentOS.
iptables
First, copied the list into a text file called bad_ips. Then run this script:
for ip in $(grep -v "#" bad_ips | egrep -v "^$"); \
do iptables -I INPUT -s $ip -j DROP; \
done
The first grep in that command gets rid of lines with comments while the egrep gets rid of blank lines.
Then you can do
service iptables save
Looking in the /etc/sysconfig/iptables file you'll see all those IP addresses are now blocked.
This isn't the end all solution. There's no reason a spammer couldn't spin up an AWS instance on sovereign Oregon soil and hit me even closer. But this should be a good start.