On blocking Chinese IP addresses

[bargainbloodhound]

I'm providing a link to this article because I'm tempted to join these people in blocking every IP address range in China due to a huge increase in security problems/attacks/breakin attempts that are all originating from servers in China (with a few related ones in Vancouver (Canada) and Australia.

On the average day on this server we have anywhere from 16-20 people who try to break into the server through SSH  by running random password generator programs.  This weekend we've also had the "privilege" of coming under attack twice  by groups of computers in China.  Last night's attack was mounted from about 1000 servers, and this morning's attack from about 500 servers...yeah, I had better things to do at 6 am on a Sunday morning than spend 1 1/2 hours blocking IPs, killing processes, and fighting off an attack.   

The bad thing is, if you block entire IP ranges you are also blocking legitimate web surfers from accessing your sites/servers...so you have to weigh the positives of increased security with the negatives of losing regular visitors (or customers) when making any decision to block IP addresses.

http://www.theregister.co.uk/2005/08/31/...addresses/

[amy]

make that 3 attacks this weekend  the one tonight actually brought the server down  :angry017: