Re: user {}

On Tue, Jan 20, 2004 at 12:54:14PM +0100, Johan Segernäs wrote:
> Andy Smith wrote:
> > I think only by duplicating the test you wish to do, like this:
> > Using these settings, users from safe.example.com will be subject to
> > "default" and "trusted" scanners.  Users from evil.example.com will
> > be subject to "default" and "untrusted" scanners, and users from
> > random.example.com will get only the "default" scanner.
> 
> But this isn't exactly what I want do to. I'd like users from
> safe.example.com to be scanned with 'trusted', random.example.com to be
> scanned by 'default' and unstrusted with 'extended', if I try to
> simplify it a bit.

And I'm saying you can't, hence you have to put common things for
ALL users in "default" and then duplicate the tests from "trusted"
that also apply for "untrusted", into "untrusted".

> I trust .se and some other domains and I dont want more abuse-reports
> than necessary and would like to exclude them from portscans.
> 
> How about you people who use BOPM, how often to you get abuse-reports on
> you? Does people care about portscans anymore? Me myself is way to lazy
> to report portscans now but I used to do it a few years ago.

There are plenty of people with automated tools, they send
auto-whines to your WHOIS contacts for the IP.  If you do not want
the email addresses that are found in "whois <yourip>" to get abuse
reports about you then I suggest you don't use BOPM.

Pretty much any IRC hosting company will be happy to eat the abuse
reports for this, but networks that don't realise they are actually
running IRC servers may not like to find out that way.

On Blitzed, one of our busiest servers that gets 1-2 connections per
minute[1] would get an auto-whine every few months.  Your mileage
will vary very much though.

-- 
Andy Smith -- Occasional BOPM Developer And Support Monkey.  Please copy
all BOPM support queries to the BOPM list, _not_ just directly to me!
If I've helped you with BOPM then please check my wishlist!
http://www.amazon.co.uk/exec/obidos/registry/23IJ4U7N4J3X9

[1] Yes I am aware this is not busy.  But this is a normal
    connection rate for a network with less than a few thousand
    users that is not under attack.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFADRpjIJm2TL8VSQsRAqsXAJ4mD2s02PfNOxce3oz/or9uOnlg3QCgkSod
aq0HYpB0cCxhQxr792jmGnU=
=6IlH
-----END PGP SIGNATURE-----