up vote 1 down vote favorite
share [g+] share [fb]

I am hosting a bunch of PHP web sites on a web server. While I have taken all precautionary mesaures to protect all ports, Port 80 specific attacks continue. I want to ban any IP Address that taken an active interest in any web page(s) more than say 200 in an hour, or 15 in a minute. I am assuming that a human user cannot surf 15 pages in a minute unless he has reasons that are indeed worth suspecting.

Ideally I would like the IP Addresses to be logged into a banned databases, and also have a white listed IP Addresses for those IP Addresses belonging to my client.

Is there any ready tool which does all this. I saw fail2ban and it does not serve the purpose...

link|improve this question
43% accept rate
What about proxies and NAT? All employees of a given office will likely come from the same public IP address. – Julien Jul 21 '11 at 15:19
feedback

2 Answers

up vote 7 down vote accepted

What you need to do is this: 1) Watch the apache logs for access 2) block IP addresses that you qualify on the firewall (via a script).

fail2ban will do what you want, with a little more work than reading the Google search tagline.

link|improve this answer
Also, be sure to white list search engine's bots. You can use a /robots.txt file to tell them what not to index. – Chris Nava Jul 21 '11 at 14:34
feedback
up vote 1 down vote

How about using existing services such as Project Honeypot?

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.