Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

When we see unusual behaviour on our site I am block IP addresses by adding them to the Apache config as so:

<Directory /var/www/html>
  Options FollowSymLinks
  AllowOverride All
  Order allow,deny
  Allow from all
  Deny from 1.1.1.1
  Deny from 2.2.2.2
  # and so on...
</Directory>

This soon becomes unwieldy so is there a standard way of dealing with this? Perhaps moving the list of banned IPs to a file?

Thanks

share|improve this question

3 Answers 3

up vote 4 down vote accepted

I'd go with putting all your denies in a file:

# /etc/apache2/banned_ips.conf
Deny from 1.1.1.1
Deny from 2.2.2.2

Then include that in your vhost:

<Directory /var/www/html>
  Options FollowSymLinks
  AllowOverride All
  Order allow,deny
  Allow from all
  include /etc/apache2/banned_ips.conf
  # and so on...
</Directory>
share|improve this answer
    
Note: missing 'from'. Should be 'Deny from 1.1.1.1' –  Olly Jan 14 '10 at 10:47
    
Whoops, missed that bit. Answer updated. –  womble Jan 14 '10 at 20:54
    
This still requires that you restart apache every time you add to the file, though. –  Darren Chamberlain Jan 15 '10 at 0:05
    
No it doesn't. A reload will work perfectly well. –  womble Jan 15 '10 at 0:07

If you are getting a not-so-nice behaviour from those IPs maybe it would be a better idea to block them at firewall level than in Apache, that way you will save Apache some load. One of the bad side of this approach is that will lose those "attacks" from your Apache logs (although that may be a pro instead of a bad thing).

If you are using some kind of firewall it will surely have a easy way of adding bad IPs. If you don't have one in the web servers you should try to install one in you systems: I would recommend shorewall for Linux, or maybe a simple iptables script if you just want to block the access to the web server.

share|improve this answer
1  
This is also a good idea, but solid documentation of this approach is a must, as it's not particularly "discoverable" if you need to go troubleshoot a problem. –  womble Jan 14 '10 at 10:40

There is a few options here...

mod_security

mod_security for Apache seems like the obvious choice as it can directly integrate with IPTables and block users at the TCP/IP level (rather than user-space).

Have a look here for an explanation http://spamcleaner.org/en/misc/modsec2ipt.html

csf / iptables firewall

I would be inclined to configure a software firewall like CSF - which can add another layer of protection, by rate limiting/blocking abusive IPs.

fail2ban

It takes a bit of configuration, but you can do some really clever things with this. http://www.fail2ban.org/wiki/index.php/Apache

Your current way

Also, to comment on your original post, you can but multiple IPs on one line of the allow/deny directive, see http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html

Finally, if you were to continue to use your method - you can block at the .htaccess level with the same syntax (minus the tags)

Eg.

order allow,deny
allow from all
deny from 1.1.1.1 2.2.2.2 3.3.3.3/24

Your current method seems un-scalable and relies on your ability to judge genuine/malicious traffic - so the automated solutions above would be highly recommended.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.