Iptables – Parse Apache logfile and ban IPs

ddosiptablesloggingparsingweb

My server is under attack, it is flooded with request with the following pattern:

Thousands of IPs
Each IP request the same page "GET / HTTP/1.1" with the same referrer 3-5 times per second (same timestamp).

So what I would need is a small shell script which takes the input from "tail -f /var/www/log/access.log" and parses the same for repeated requests with the same timestamp (say 2 request for the same page with same referrer and same time) and adds a iptable rule to drop all packets from this IP.

Best Answer

Have a look at Fail2Ban and at this Howto for an example of filters for Apache log files.

Here's an example that should accomplish what you ask. Please see the manual and adjust to your needs:

/etc/fail2ban/filters.d/apache-attackers.conf

[Definition]
failregex = <HOST> - - [[^]]+] "GET / HTTP/1.1" 200 .* "REFERER"

/etc/fail2ban/local.jail

[DEFAULT]
ignoreip = 127.0.0.1 <an IP you access the system from>

[apache-attackers]
enabled = true
port    = http,https
filter  = apache-attackers
bantime = 86400
logpath = /var/log/httpd/*access_log
maxretry = 5

Enable fail2ban at startup (RHEL/CentOS) and launch it:

chkconfig fail2ban on
service fail2ban start

Note: Tested on RHEL/CentOS, your mileage may vary.

Related Topic