Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm getting log notices of activity's such as users trying to access /js/cache/'+opts.iframeSrc+' and other suspicious looking failed Javascript and MYSQL injections. However these seem to come from an ip addresses that changes daily. (maybe proxies or just a different connection.)

How should I deal with this? Is there a way I can add them to an ip blacklist on Apache for 24 hours, or something? The ip address is changing all the time so I don't want have a massive list of ip's that might at some point belong to potential visitors.

share|improve this question
1  
If these attempts are answered by 4xy or 5xy errors, then ignore them. It's not worth thinking about a solution when there is no problem. –  mailq Sep 11 '11 at 13:02

4 Answers 4

Take a look at Fail2ban and set bantime = 86400 (for 24h).

If you use iptables, you can unban an IP with:

iptables -D fail2ban-apache -s IP -j DROP
share|improve this answer

mod_security is a different approach that you can use to block the access. Is a totally different approach because it will be applied from Apache but it will protect you from unknown and unexpected attacks.

You can check it at http://www.modsecurity.org/

share|improve this answer

You can always install http://www.ossec.net/ and you will get all sorts of "anti-hacking" protection mechanisms, even on the default configuration! It temporary bans ips and you can add extra configurations n all, for multiple services.

share|improve this answer

If you want something simple; take a look at fail2ban or sshguard.

sshguard is arguably better as it doesn't use python and the name is something of a misnomer; it does much more than just protecting ssh. - http://www.sshguard.net/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.