[SOLVED] is there a way to block ips based on apache2 errors?

jonjetjon · 12-01-2014, 04:49 PM

my webserver has been under attack for quite some time now, it is a basic http attack looking for a forums link(which no longer exists) that generates an apache error starting with "GET /forums/showthread.php?" is there a way i can write a shell script to auto add ips that generate this error to iptables as a blocked ip? that way the lag will be greatly reduced.

bowenmark · 12-01-2014, 05:57 PM

You can use htaccess for this, more info at the Apache web site

Additionally, using iptables you can limit the number of pings per minute, more here.

Also, you can use OSSEC

jonjetjon · 12-01-2014, 09:41 PM

since it's an attack specifically designed to take up bandwidth and processing power(which i believe letting it get to apache would still use) i would like to add all these ip's to a complete blocklist in the iptables, the problem is, there are about 100 and i want to add them to iptables automatically when they try and access that file.

bathory · 12-02-2014, 03:49 AM

Quote:

Originally Posted by jonjetjon

since it's an attack specifically designed to take up bandwidth and processing power(which i believe letting it get to apache would still use) i would like to add all these ip's to a complete blocklist in the iptables, the problem is, there are about 100 and i want to add them to iptables automatically when they try and access that file.

You can use fail2ban for this

Regards

jonjetjon · 12-02-2014, 04:38 PM

thank you so much! fail2ban is exactly what i was looking for!