Block Vulnerability Scans - Iptables Equivalent?

[Rosanne]

We're getting a number of vulnerability scans against our site. Blocking individual IPs isn't a solution - too many of them. One pretty solution I saw used iptables. Now, I know just enough Linux and network configuration to be dangerous, but I suspect that iptables would only be an option on dedicated servers. Is there a way for virtual servers to drop the connection based on a string, rather than an IP?

 

It's not a huge deal - since we don't run PHP those scans are all logging 404s, but seeing them in our logs offends me - sort of an OCD thing. :-)

 

~ Rosanne

[TCH-Bala]

Hosting the account on a shared server, there are limits on what you can achieve simply because you will need higher level access. There are thousands of scripts running in the internet scanning for outdated and insecure scripts, but they just move on once they find there is nothing to break in. All that is required from you is to make sure that you are running the latest stable version of any script that you install, keep updating it as and when there is a new release and rotate your password to a very strong string at regular intervals, atleast once a month.