Re: [mod-security-users] Can we consume Third Part IP reputation list?

[Blason R <bla...@gm...>]

Hi there,

Sorry for the confusion. What I mean about third party is; I saw modsec can
only consume rbl but since we are running our own honeypot we are
generating out own feeds and waned to know if those can be consumed instead
of default one.

Since I am pretty novice my apology for any confusion.

On Mon, Apr 13, 2020 at 5:37 PM Reindl Harald <h.r...@th...>
wrote:

>
>
> Am 13.04.20 um 13:54 schrieb Blason R:
> > Well since we are gathering the events through specific high interaction
> > Honeypots wanted to specifically rely on our IP list. Please suggest the
> > changes that I need to make to achieve this?
>
> you are asking "can consume any third party IP reputation list" in
> context of "Just like we internally generate our own IP reputation list"
>
> jesus, you do the same with the same syntax and if you want to know "how
> can i use RBL with modsec" than ask that instead talking about "third
> party IP reputation list Just like we internally generate our own IP
> reputation list"
>
> https://malware.expert/howto/modsecurity-rbl-database/
>
> > On Mon, Apr 13, 2020 at 4:44 PM Reindl Harald <h.r...@th...
> > <mailto:h.r...@th...>> wrote:
> >
> >
> >
> >     Am 13.04.20 um 13:04 schrieb Blason R:
> >     > Wondering if we can consume any third party IP reputation list
> through
> >     > modsec?
> >     > Just like we internally generate our own IP reputation list through
> >     > honeypot and wanted to know if I can use that?
> >
> >     you can but besides performance consideration you won#t find any RBL
> you
> >     can trust enough
> >
> >     why do you think modsec, postfix or any other software distincts
> between
> >     your RBL or a external RBL? same techniqe and same syntax
> >
> >     was cool last year as spamhaus XBL started at friday evening with
> >     positive responses for every IP and we had used it only for
> form-submits
> >     (because of performance consideration)
>
>
>
> _______________________________________________
> mod-security-users mailing list
> mod...@li...
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>