Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In one of the vhosts' error_log I found thousands of lines like these, all from the same IP:

[Mon Apr 19 08:15:59 2010] [error] [client] mod_security: Access denied with code 403. Pattern match "(chr|fwrite|fopen|system|e?chr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)\\\\(.*\\\\)\\\\;" at THE_REQUEST [id "330001"] [rev "1"] [msg "Generic PHP exploit pattern denied"] [severity "CRITICAL"] [hostname "x.x.x.x"] [uri "//webmail/;"]

Given how obvious the situation is, how come mod_security isnt automatically adding at least that IP to deny rules? There is no way someone hasnt thought of this before...

share|improve this question
up vote 1 down vote accepted

If it's from the same IP, perhaps you should just block it on the firewall level?

But for APF this post should help.

share|improve this answer
I already blocked the entire class C via APF (it's in china. we have absolutely no interest in chinese visitors.), but my question is exactly how do I make this happen automatically? – Gaia Apr 22 '10 at 16:29
You can write a script analyze our log file for mod_security: Access denied with code 403, extract the IP address, count a number of times it appears in the log, and if exceeds some kind of threshold, run a command to block that IP. – solefald Apr 22 '10 at 16:57
that would be beyond my skill level... unless you want to assist with such script. what do you recommend? a perl script, cron'ed to run every 5 minutes, that reads the log file and adds to deny.rules when condition X is true? off topic: i've been a windows admin for a over a decade. i'm using LAMP because the best web applications (such as wordpress) run better on it, but damn so many simple basic things become so complicated in linux... – Gaia Apr 22 '10 at 23:45
Here is a quick and dirty shell one-liner that can extract the IP addresses, and count them. grep "mod_security: Access denied with code 403" access.log | awk -F\ '{print $8}' | sed -e s/\]// | uniq -c | sort. Run this command but replace access.log with the pass to your log file. See if it works for you. You can have a shell script run every time apache log rotates. No need to run it from cron, really. – solefald Apr 23 '10 at 0:28
thanks, i will give it a try. how do i set the script to run when the log rotates? – Gaia Apr 23 '10 at 22:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.