Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If some one tried force burst attack on my website, how can I block them?

Ideally, I want to block an IP if I have many http/Apache requests in a second.

share|improve this question

3 Answers 3

up vote 4 down vote accepted

fail2ban can be configured to do this. You can configure it to trigger on a regex match in a logfile and if it happens too many times per minute (not sure if it goes to second resolution but just multiply whatever you were thinking per second by 60) and it can drop the client IP into the iptables packet filter or whatever other action you want taken. Or you can use the iptables recent module and adapt what I've done here for SIP brute force attacks to use with your web server:

http://tracyreed.org/blog/2010/12/26/sip-brute-force-attacks

share|improve this answer

fail2ban is an easy-to-implement solution in these cases.

Add a block-all-dem-noobs.conf file to your filter.d directory, something like this

failregex = ^ -.*GET

Translation: a RegExp to find GET requests

Then create a new entry in your jail.conf, something like this

[block-all-dem-noobs]
enabled = true
port = http,https
filter = block-all-dem-noobs
logpath = /var/log/httpd/access.log
maxretry = 100
findtime = 5
bantime = 600
action = iptables[name=HTTP, port=http, protocol=tcp]

Translation: Look through my access.log file, then block for 600 seconds (10 minutes) the IP addresses that made 100 requests in 5 seconds

One major drawback, though, is that this might produce false positives for NATed users, as they'll all appear as one IP address to you.

share|improve this answer

You can configure Apache mod_evasive module. This module provides a very basic function by keeping a hash table of IPs and pages requested and when a threshold level is exceeded on a target page or site it will “block” the IP with a 403 “Forbidden” error. For configuration details you read "How to Stop an Apache DDoS Attack with mod_evasive".

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.