Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am hosting a bunch of PHP web sites on a web server. While I have taken all precautionary mesaures to protect all ports, Port 80 specific attacks continue. I want to ban any IP Address that taken an active interest in any web page(s) more than say 200 in an hour, or 15 in a minute. I am assuming that a human user cannot surf 15 pages in a minute unless he has reasons that are indeed worth suspecting.

Ideally I would like the IP Addresses to be logged into a banned databases, and also have a white listed IP Addresses for those IP Addresses belonging to my client.

Is there any ready tool which does all this. I saw fail2ban and it does not serve the purpose...

share|improve this question
    
What about proxies and NAT? All employees of a given office will likely come from the same public IP address. –  Julien Jul 21 '11 at 15:19

2 Answers 2

up vote 7 down vote accepted

What you need to do is this: 1) Watch the apache logs for access 2) block IP addresses that you qualify on the firewall (via a script).

fail2ban will do what you want, with a little more work than reading the Google search tagline.

share|improve this answer
    
Also, be sure to white list search engine's bots. You can use a /robots.txt file to tell them what not to index. –  Chris Nava Jul 21 '11 at 14:34

How about using existing services such as Project Honeypot?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.