Hi All,

I'm getting a load of hassle with people trying to hack my apache 2 server. The main problem is the use of automated scanning tools directed at my cgi scripts.

To counter this I am looking at writing a perl script to monitor requests and block any ip making too many requests over a time period. This isn't a problem for my scripts but most of the requests are speculative and aimed at cgi programs that don't exist. To be able to respond to this I would like to have apache call my monitoring script whenever a request is made to cgi-bin.

I can go the route of changenotify and parse the logs for unnatural access but a more elegant solution would be to have apache call my script when a cgi request is made.

Any ideas?

Thanks

There are tools available to do what you wish.

Some ideas.
Iptables limit and recent match. Which can be used to drop packets over n simultaneous connection attempts from an ip.
fail2ban - scans log files, and generates firewall rules to "ban" IP's, and can also do additional things, like email alerts, with whois lookups for example.