Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am administering a few web servers. Each night, random hosts from the Internet are probing them for various vulnerabilities in php, phpadmin, horde, mysqladmin, etc. Is there a way (apache plugin?) to slow down the rate of attack?

For SSH, I have a rate limiting rule on the firewall, which does not allow more than three connections per minute. But I don't want to rate limit all HTTP access, only the access that returns 404s.

Is there such an apache module?

share|improve this question

3 Answers 3

up vote 3 down vote accepted

Here is an article about how to setup tarptting with apache.

share|improve this answer
    
For bonus points, do you know where I can find a RPM for Centos 5.5? –  florin Jun 1 '10 at 20:07
    
I found jasonlitka.com/media/EL5/i386 but I get an error Starting httpd: httpd: Syntax error on line 210 of /etc/httpd/conf/httpd.conf: Syntax error on line 3 of /etc/httpd/conf.d/mod_security.conf: Cannot load /etc/httpd/modules/mod_security2.so into server: /etc/httpd/modules/mod_security2.so: undefined symbol: ap_get_server_banner –  florin Jun 1 '10 at 20:13

Use apache mod_security.
Sample from .conf:
Include modsecurity.d/modsecurity_crs_35_bad_robots.conf
Include modsecurity.d/modsecurity_crs_40_generic_attacks.conf
Include modsecurity.d/modsecurity_crs_45_trojans.conf
Include modsecurity.d/modsecurity_crs_50_outbound.conf

For ssh, ftp and other use fail2ban.
Bafta.

share|improve this answer

mod_memcache_block might be what you need. From the docs:

"mod_memcache_block is an Apache module that allows you to block access to your servers using a block list stored in memcache. It also offers distributed rate limiting based on HTTP response code.

Features

Distributed White and Black listing of IPs, ranges, and CIDR blocks Configurable timeouts, memcache server listings Support for continuous hasing using libmemcached’s Ketama Windowded Rate limiting based on Response code (to block brute-force dictionary attacks against .htpasswd, for example)"

Hope this helps.

share|improve this answer
    
This solution is indeed more elegant and scalable than the one proposed by Zoredache, but that one is easier to implement for a small site. I'm sorry I can't mark both as good. –  florin Jun 1 '10 at 20:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.