Auto ban failed hack attempts

apache-2.2

I'm getting log notices of activity's such as users trying to access /js/cache/'+opts.iframeSrc+' and other suspicious looking failed Javascript and MYSQL injections.
However these seem to come from an ip addresses that changes daily. (maybe proxies or just a different connection.)

How should I deal with this? Is there a way I can add them to an ip blacklist on Apache for 24 hours, or something? The ip address is changing all the time so I don't want have a massive list of ip's that might at some point belong to potential visitors.

Best Answer

Take a look at Fail2ban and set bantime = 86400 (for 24h).

If you use iptables, you can unban an IP with:

iptables -D fail2ban-apache -s IP -j DROP

Related Solutions

Returning 404 code for unauthorized attempts

Well, close:

<Location /admin>
     Order deny,allow
     Allow from 10.0.0.1
     Allow from 192.168.1.1
     Deny from all
</Location>

Though what this actually does is return a 403 Forbidden, not a 404 Not Found, which is, y'know, correct.

If you're putting this in a .htaccess in the admin directory, you don't need the Location container. The example is written for a server or virtual host configuration file.

Linux – Automatically Blacklist Failed Auth Attempts Via htaccess

Do you have root access to the server? There are a few programs that monitor log files for changes, checking for failed auth attempts. After X many failed attempts (user configurable) they then block the originating IP address (temporarily, if desired).

The two that I can remember are:

Fail2ban: install with sudo apt-get install fail2ban in Ubuntu then change the /etc/fail2ban/jail.local file (if it doesn't exist, just sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local ). The options in 'jail.local' are pretty self-explatatory but if you want more info you can check out the documentation at http://www.fail2ban.org/wiki/index.php/Main_Page
BlockHosts: (it's a little older, i'm not sure if it's still up to date) To install, follow the instructions at http://aczoom.com/cms/blockhosts
there are probably a whole heap more...

Best Answer

Related Solutions

Returning 404 code for unauthorized attempts

Linux – Automatically Blacklist Failed Auth Attempts Via htaccess

Related Topic