A common type of abuse is a denial-of-service type attack, wherein one of the network services is used excessively or rudely.

We have a couple of defenses:

• fail2ban (protecting several ports where we don't support logins but attacker try anyway)

fail2ban-client status postfix
fail2ban-client status moinmoin

• nginx blacklist & whitelist

/etc/nginx/snippets/locations-git-throttle.conf
/etc/nginx/blacklist.geo
/etc/nginx/goodguys.geo.manual
/etc/nginx/goodguys.geo  # automatically regenerated (cron.daily)

• httpd blocklist obsolete

/etc/httpd/conf.d/block.include*

• httpd mod_qos (for targeted load shedding of temporarily overused services like gitweb) obsolete

egrep 'QS|qos' /etc/httpd/conf.d/*
links http://localhost/qos
links http://localhost/server-info

• fail2ban tarpit

fail2ban-client set manual banip 1.2.3.0/24
fail2ban-client set manual unbanip  4.6.0.0/14
fail2ban-client status manual

• firewalld tarpit (more opaque)

firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address='IP.ADDR/NETMASK' reject"
firewall-cmd --reload