Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite
2

How can I go about killing IP connections that seem to be sending a lot of requests to the same url? Let's say I have someone who requests the same url for more than 10 times in 5 seconds, I want to "cool" him off. Any ideas on how it's done?

share|improve this question

2 Answers

up vote 5 down vote

On *nix, you can use fail2ban with a something like this in your jail.conf (100 requests in 30 seconds means a 5 minute ban). Of course, you'll have to adjust this for how many requests you expect from a legitimate user -- as @Jeff Ferland points out in the comments below, you need to account for the number of requests that you receive on a normal page load (e.g. you have a lot of images on the page).

[apache-spammer]

enabled = true
banaction = apache
port    = http,https
filter  = apache-spammer
logpath = /srv/*/log/access.log
maxretry = 100
findtime = 30
bantime = 300

and a filter like this in /etc/fail2ban/filter.d/apache-spammer.conf:

[Definition]

# Option:  failregex
# Notes.:  regex to match the request messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
#
failregex = ^<HOST>.*/path/to/content.html

This is untested -- you'll have to experiment a bit to find what works. Watch your fail2ban.log to verify that you aren't banning innocent users!

An alternative would be a firewall rule that rate-limits requests from a particular IP address.

share|improve this answer
See also: serverfault.com/questions/208341/… – bstpierre Dec 19 '11 at 21:55
10 requests in 30 seconds is far too low, and that will match 10 requests of anything. Load a page with 9 images on it once and you're in the doghouse for five minutes. – Jeff Ferland♦ Dec 19 '11 at 21:55
and: serverfault.com/questions/310599/… – bstpierre Dec 19 '11 at 21:56
1  
@JeffFerland: I don't think so: the regex in the filter file will only match the URL(s) that you specify. So an innocent user requesting 200 images+scripts+css all at once won't be affected, just the malicious request for the same "content.html" 10 times in 30 seconds (or whatever N times in M seconds the OP wants to set as a bound). Just as long as the filter file doesn't specify a broad wildcard to match all the embedded content that an innocent user is going to pull on each page load. – bstpierre Dec 19 '11 at 22:07
up vote 2 down vote

Would mod_evasive be what you're looking for? It's focused on DoS attacks and limits the number of requests to a page per second. Otherwise, you might be able to adapt fail2ban to help out.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.