0

I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the URL that was used.

The other day I got 8,400 emails in 50 minutes, nothing my mail server can't handle, but all from some IP proxy in the US.

Now I am thinking of hardening my code by adding some time sensitive (hindering) factor into the equation. The idea is to send them a redirect to somewhere else (fbi?) for a set time period, after an initial warning; provided they reach that emails code.

Should I have IIS handle this (simple to implement,) or is it better for Apache to handled it? I would think so it there is such a function in Apache.

In IIS I could start a session logging IP addresses of bad actors, and block their access to the site. Or has Apache something that could block these request for a set time period?

And how would I implement this IIS to Apache handover, maybe via some header?

1

Now I am thinking of hardening my code by adding some time sensitive (hindering) factor into the equation. The idea is to send them a redirect to somewhere else (fbi?) for a set time period, after an initial warning; provided they reach that emails code.

Most attacks are automated, so it's likely that your warning will not be seen or taken into consideration. Besides, the bad actors should normally be hiding their real IP address and using some proxy/VPN.

If I understand this right, the Apache server acts as some sort of reverse proxy. I would set up the front-line defense on the Apache server first instead of the IIS server.

What I would do is simply block the IP addresses at firewall level, automatically. In Linux this can be done with tools like Fail2Ban or CSF+LFD. These tools work by watching log files in real time and add firewall rules to ban offenders from making any further connections until the ban expires. They are mostly used to watch failed SSH attempts but also monitor other services such as POP/IMAP/SMTP/FTP etc.

You may need to add a custom rule and point to a specific log file but that shouldn't be too difficult.

Plus, Apache has a WAF module AFAIK. There may be some tools already available for the purpose.

Bottom line: don't contain the attackers, block them. You can have fun with the wannabe hackers and frustrate their efforts but I feel that blocking them is more straightforward and will save server and network resources.

At some point, your server may have to handle hundreds or thousands of concurrent malicious requests and your server could literally be overwhelmed fending off the attacks.

2
  • I am running Apache on a Windows system, so I would need something that would block IP addresses within the Windows Firewall. I see Fail2Ban runs on python, but can it be configured to support Window Firewall? Or is there something more appropriate for Windows?
    – MeSo2
    Jul 7 '20 at 3:35
  • I ended up blocking IP addresses as suggested here is the batch file and code to call it in IIS
    – MeSo2
    Jul 17 '20 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.