LinkBack URL
About LinkBacksIs there any way to create rules in mod_security that will block an IP from the server completely if they are found to be accessing a certain address or access it more than once?
mod_security rules
Is there any way to create rules in mod_security that will block an IP from the server completely if they are found to be accessing a certain address or access it more than once?
Why not just ban the IP on your firewall?
Indeed, that's not what mod_security is for. As celliott says, use your iptables firewall (if you're using linux) or block using the standard apache allow/deny directives in httpd.conf.
Jonathan Michaelson
Need your cPanel servers secured and tuned?
cPanel Server Configuration, Security, Recovery and Antivirus/AntiSpam Services
Developers of the most effective (and free) Firewall & Security Solution for cPanel Servers - csf
http://www.configserver.com
It would be great to make some rule to communicate an "x" attacker IP (when mod security already detected apache is being attacked) with the firewall rules to automatically block those bad guys... Does anyone know how to do this with for example APF?
thkz!
I was just curious if it could be made to block an IP via iptables. Blocking them manually is typically a fruitless effort as most are using proxies which change everyday, but if I can identify certain rules to block an IP after one or two attempts it could stop their scan of a bunch of other address on the server at the time.
Add it into APF.. Works great for us...
LOL! ROFL! Sorry about the laughing .... there is sort of an inside joke relatedOriginally Posted by Jimmyftw
to your comment but I will do my best to try to explain:
Our hosting service developed a new technology that allows us to see backwards
through any proxy server or even a chain of proxy servers back to the real IP
effectively rendering all anonymous / privacy type services totally useless.
It's pretty funny to watch bad users try to beat our bans. Most give up quickly
but we had one guy keep trying for 3 weeks before he finally gave up while
we just sat back and enjoyed the show.
How did you did it ?? please tell us
huh??? how??LOL! ROFL! Sorry about the laughing .... there is sort of an inside joke related
to your comment but I will do my best to try to explain:
Our hosting service developed a new technology that allows us to see backwards
through any proxy server or even a chain of proxy servers back to the real IP
effectively rendering all anonymous / privacy type services totally useless.
It's pretty funny to watch bad users try to beat our bans. Most give up quickly
but we had one guy keep trying for 3 weeks before he finally gave up while
we just sat back and enjoyed the show.
Just keeping my "eye" on things....
R. Paul Mathews
RPMWS - diehard cPanel Nutcase
If you have APF installed on your system you should know the basic commands to make proper use of it.How did you did it ?? please tell us
Go into ssh as root and type "apf -d xx.xx.xxx.x.xx" without quotes obviously. replace xx.xx etc with the IP or Host you wish to ban. This will add the entry into Iptables. You should then reload apf by running /usr/local/sbin/apf -s
I think he meant how did user Spiral implement his anti-proxy technology.
Of course I know this, :S
Like the other guy said... It would be great to communicate and ban from APF automatically an offending IP taked from mod security logs, i mean, automatically
Anyone have some ideas about how can be done?
thkz!
If you use BFD (from RFXNetworks - like APF), you can then add a rule to scan the Apache logs and if a certain string appears more than a certain amount, it can auto-add the IP add to the firewall blocklist (I've configued BFD to scan my exim_rejectlog for "Mail delivery failed due to listing in RBL ...." style messages and auto-blacklist after 5 mails: the amount of processing my server has to do scanning email has slumped! Wouldn't recommend this way for a shared hosting environment though as it's a bit too "paranoid").
Can you give us details about how did you configure it, maybe an example rule ?
thkz!
That would not work well since WHM + mod-sec uses a db to store audit_log after a while.
I'm looking to implement this I have seen more than 5 violations per sec on in my logs.
Reply With Quote