Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I get many attacks on my debian apache server that include URL-manipulations like


How can I block these attacks?

share|improve this question
up vote 1 down vote accepted

Fail2Ban should never be your first line of defense, after properly handling the input you can utilize Fail2Ban by using a failregex like this

failregex = ^<HOST> -.*GET.*\/etc\/passwd

Another commonly used filter to block the PHP File Injection/Inclusion attacks


enabled = true
port    = http,https
filter  = php-url-fopen
maxretry = 1

You can include that in your jail.conf

Update: As a response to your comment, you can use multiple lines in logpath, for example:

logpath = /somepath/*wild/log
share|improve this answer
thanks, I added this to my /etc/fail2ban/filter.d/php-url-fopen.conf: failregex = ^<HOST> -.*"(GET|POST).*\?.*\=\/(etc|proc)\/.* HTTP\/.*$ – rubo77 Dec 17 '12 at 15:56
I use logpath = /var/kunden/logs/*access.log but how can I add another path too? I also have logs in /var/log/apache2/*access.log – rubo77 Dec 17 '12 at 16:02
@rubo77, I've updated the answer for you – Adi Dec 17 '12 at 16:09
could it be, that too many logfiles in the apachelog will slow the server down, if you use fail2ban filters? (at my server over 250 differing logfiles, one for each customer) – rubo77 Dec 18 '12 at 6:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.