Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Currently I'm using Blockhosts & mod_evasive to "manage" minor attacks & spurious requests, I'm wondering if there is something better/more effective out there. Something that behaves like mod_evasive, monitoring requests as they come in but has the ability to control what gets blocked using keywords or regex.

For example, anytime anyone requests something like "../etc/passwd" - I would like to drop that IP address for a few days. I've looked at fail2ban as well, but it does the same thing as blockhosts, monitors log files. not exactly what I am looking for.

Anyway, the server is CentOS running Apache 2.2, in a paralells virtual host container & hosting about 100 sites, so I only have web access to the virtual machines host servers firewall & trying to jam in rewrite rules in each domain's htaccess will not be maintainable.

Any suggestions?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

The module you are looking for is mod_security. It lets you build custom rulesets to block types of attacks. Installing mod_security is not enough you also need to get a good ruleset.

At a larger scale, I would look into Cloudflare. They are a live updating service that performs the same functions.

share|improve this answer
2  
+1 Here are links for mod_security and a good mod_security ruleset. –  xofer Sep 11 '11 at 16:44
    
Just scanning the docs now, what sort of memory footprint does it have? I'm running apache as prefork, so each process will use more ram. I thought cloudflare was just a caching utility [and not free] - I'll have to dig more to see if it can be used without caching features & over all sites [as I need something maintainable] –  Sean Kimball Sep 11 '11 at 16:55
    
@fuscata, thanks for the ruleset link. Owasp does good stuff. At the last place I work we paid for a commercial ruleset. Not going to link to that one here. Sean - mod_security adds overhead, but as long as your rules are tightly defined its not brutal. Cloudflare's basic service is free, it was started as a security tool, not a CDN replacement. –  n8whnp Sep 12 '11 at 4:33
    
Looking at mod_security - it looks like it needs to be compiled with apache - is there no option to load it dynamically? –  Sean Kimball Sep 13 '11 at 1:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.