2

I have a simple Apache webserver setup and basic IP tables (ufw) for a development server. In my logs I see lines like this:

[Fri May 16 10:10:36.258369 2014] [:error] [pid 15926] [client 69.147.158.130:8396] script '/var/www/html/wp-login.php' not found or unable to stat

I am not running WordPress at all, and I realize this is a very minor attempt at a hack (there are much more sophisticated attacks against Apache out there). However I would like to automatically block this IP address (temporarily) without installing an IDS/IPS such as Snort.

I am just looking for a simple way to block an address that tries to connect to wp-admin or wp-login. Is there an Apache module that would handle something like this?

6
  • 6
    fail2ban.org/wiki/index.php/Apache
    – ceejayoz
    May 16, 2014 at 17:32
  • 1
    Have you considered the DoS potential such automated blocking has, when attacks and legitimate requests originate from the same IP? Are you sure none of your legitimate users have to access your site through a CGN?
    – kasperd
    May 16, 2014 at 17:33
  • @ceejayoz Ah, that does exactly what I was looking for, thank you. I apologize if the question seemed easy to answer with a little research, however when trying to google it, all I was finding was ways to secure wordpress (obviously I wasn't asking google the right question). May 16, 2014 at 17:36
  • @kasperd - it's a development server ;)
    – user9517
    May 16, 2014 at 17:41
  • @kasperd I see your point, and a very good one at that. Of course the blocks are temporary (say 15 minutes), and only in place to deter further hacking attempts. The user base is for beta testing functionality. (of course once completion of beta testing, the app is moved into a production / properly secured -by people who know more about security than me- environment) May 16, 2014 at 17:45

3 Answers 3

1

While you are clearly asking for a solution to block IP addresses, I don't think that is a good solution.

The reason being that these attempts you see are coming from various IP addresses most likely controlled by one master system. That is simply the nature of how DDoS & hacking attempts occur nowadays.

Instead, you should look into implementing ModSecurity. It's an Apache module that acts as a web service level firewall. It analyzes all web traffic coming to your site, and if it detects known aberrant behavior, access us blocked dead in it's tracks by a "403: Forbidden" response.

Now the slightly negative side is that MidSecurity has dozens of default rule sets that work well, but might cause false positives. So when you implement it you will most likely need to tweak it for the first few weeks.

But the net result is after this "getting to know you" period you will have a tool that heuristically protects your site from known bad behavior. And not just keep a list of IP addresses.

2
  • 1
    I do in fact have ModSecurity installed and enabled already, as well the system is kept patched / security updates installed daily. I am (obviously) not a security expert, nor do I think that the server requires a tremendous amount of security due to its nature. I am just looking for that extra bit of security to deter those 'script kiddies'. Real hackers I am sure would find workarounds, but I doubt they would bother due to the lack of useful data on or accessible by this server. I will upvote as is also good information. May 16, 2014 at 22:59
  • @AaronMurray “…but I doubt they would bother due to the lack of useful data on or accessible by this server. I will up vote as is also good information.” Well, you misunderstand what these hacking attempts try to achieve. They don’t want your data. These things are really never targeted attacks. They want a server on the Internet they can infect & use as a node in malware or phishing. May 16, 2014 at 23:07
-1

I wouldn't recommend trying to do so automatically, I would recommend manually blocking the IP . The only automated system I would do would be a script or something similar that parses your logs for similar errors.

To block an IP with ufw
sudo ufw deny from <ip address>

with iptables
sudo iptables -I INPUT -s <ip address> -j DROP

2
  • I understand your given recommendation, however this does not suit my needs as it would mean babysitting my logs. The question states I need something automated (of which fail2ban noted by @ceejayoz above appears to be a simple solution to my question) May 16, 2014 at 17:54
  • @Siggy Automated systems exist. Doing what you propose manually is a hopeless task at best. Should the original poster sit on his server 24/7/365 just to add rules? May 16, 2014 at 19:24
-1

The solution that works for me is fail2ban as noted in comment by @ceejayoz

@iain - This is in fact duplicate - thank you for pointing that out.

6
  • 1
    This is not an answer. If an answer works for you mark it as such or leave a comment. But this should be removed. May 16, 2014 at 19:16
  • @JakeGould There's no other answer that I can see that advises to use fail2ban. This answer looks fine to me. May 16, 2014 at 19:34
  • @MichaelHampton This "answer" is the original poster answering their own question by simply regurgitating what ceejayoz recommends it in the comments to the question. The user ceejayoz should post a formal answer & this should be deleted. May 16, 2014 at 19:38
  • @MichaelHampton unfortunately the original person to answer it (@ceejayoz) posted the answer as a comment, so I was just repeating it in answer form so that the question could be closed. Can you tell me how else to close a question without creating an answer? May 16, 2014 at 22:41
  • I can just delete the question if you would like. May 16, 2014 at 22:42

Not the answer you're looking for? Browse other questions tagged .