Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

getting a bunch of bogus requests hitting my server.

would like to block any requests that include http:// in it.

example:

domain.com/forum/function/component.php=http://bogusdomain.gov.ve/images/foo.txt

I thought

RewriteRule ^(.*=http://) - [F] 

would do it, but it doesn't seem to work.

any suggestions?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

You haven't mentioned an OS, and this isn't what you asked for (a rewriterule) -- but it does block attacks.

I use Fail2Ban to block all kinds of junk on Ubuntu; using the webserver log, the sshd log and others.

An incident = a regexp + a log file.

A rule can say when there are NN incidents in time T add a ban in the firewall for the IP for X minutes. The default is like 10 minutes... which is good if you accidentally ban yourself. If you are not worried about that, it can be set longer.

The nice thing about this approach is that you can ban all traffic from that IP and not just traffic against the web server. Also, instead of getting an indication like REFUSED or FORBIDDEN, the traffic can simply hang and never be delivered or acknowledged.

share|improve this answer
    
OS = debian. its a vps box. Will look into Fail2ban, but was hoping for a rewrite solution - exploit attempts are coming from multiple IP's –  jimg Feb 18 '10 at 14:10
    
Fail2Ban handles multiple attackers just dandy, and can even look them up for you in whois and send a nice email somewhere for tracking or safekeeping. –  Paul Feb 18 '10 at 14:27

If you're worried about such requests you'd better tackle the source of the problem, i.e. turn allow_url_fopen off in PHP etc.

As for the rewrite rule... do other rewriterules work? (i.e. is the engine enabled?) ^.=http://.$ should match I guess, no need for the parentheses since you're not reusing the match

share|improve this answer
    
It's not a matter of worrying about the requests - they are coming in nonstop. Can't address the source of the problem - this is a bunch of bots scouring the web looking for conditions. Sure, the condition is closed (was never open on my server) but I'd rather cut off all requests of this nature at the apache level rather than taxing the server with unnecessary php cycles. and yes, other rewrites work / engine enabled. –  jimg Feb 18 '10 at 2:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.