up vote 2 down vote favorite
share [g+] share [fb]

Currently I'm using Blockhosts & mod_evasive to "manage" minor attacks & spurious requests, I'm wondering if there is something better/more effective out there. Something that behaves like mod_evasive, monitoring requests as they come in but has the ability to control what gets blocked using keywords or regex.

For example, anytime anyone requests something like "../etc/passwd" - I would like to drop that IP address for a few days. I've looked at fail2ban as well, but it does the same thing as blockhosts, monitors log files. not exactly what I am looking for.

Anyway, the server is CentOS running Apache 2.2, in a paralells virtual host container & hosting about 100 sites, so I only have web access to the virtual machines host servers firewall & trying to jam in rewrite rules in each domain's htaccess will not be maintainable.

Any suggestions?

link|improve this question
58% accept rate
feedback

1 Answer

up vote 5 down vote accepted

The module you are looking for is mod_security. It lets you build custom rulesets to block types of attacks. Installing mod_security is not enough you also need to get a good ruleset.

At a larger scale, I would look into Cloudflare. They are a live updating service that performs the same functions.

link|improve this answer
2  
+1 Here are links for mod_security and a good mod_security ruleset. – xofer Sep 11 '11 at 16:44
Just scanning the docs now, what sort of memory footprint does it have? I'm running apache as prefork, so each process will use more ram. I thought cloudflare was just a caching utility [and not free] - I'll have to dig more to see if it can be used without caching features & over all sites [as I need something maintainable] – Sean Kimball Sep 11 '11 at 16:55
@fuscata, thanks for the ruleset link. Owasp does good stuff. At the last place I work we paid for a commercial ruleset. Not going to link to that one here. Sean - mod_security adds overhead, but as long as your rules are tightly defined its not brutal. Cloudflare's basic service is free, it was started as a security tool, not a CDN replacement. – n8whnp Sep 12 '11 at 4:33
Looking at mod_security - it looks like it needs to be compiled with apache - is there no option to load it dynamically? – Sean Kimball Sep 13 '11 at 1:40
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.