Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using Apache 2.2 as a proxy for my app server.

RewriteCond %{REQUEST_URI} ^/A [OR]
RewriteCond %{REQUEST_URI} ^/B
RewriteRule (.+) http://appserver$1 [P]

In normal use, the number of legitimate requests for /A is several orders of magnitude higher than for /B

/B is vulnerable to a dictionary attack, and I would like to mitigate the risk by putting tight limits on the number of /B requests that get serviced within some time window.

How can I restrict the requests to /B without interfering with requests to /A?

share|improve this question
There are clues that I'm looking for mod_security, or mod_evasive, or mod_bandwidth, but I haven't found an example that clearly shows me which is the best fit for my circumstances. – VoiceOfUnreason Nov 4 '11 at 0:11

It appears that a reasonable answer is

    SecAction "phase:1,id:'981214',t:none,nolog,pass, \
    setvar:'tx.brute_force_protected_urls=/B', \
    setvar:'tx.brute_force_burst_time_slice=60', \
    setvar:'tx.brute_force_counter_threshold=10', \
  • update httpd.conf
<IfModule security2_module>
    Include conf/modsecurity_crs/*.conf
    Include conf/modsecurity_crs/experimental_rules/modsecurity_crs_11_brute_force.conf
  • And finally, turn it on
    SecRuleEngine On

What this gets you is is a check during the logging phase; if there has been two or more bursts, then the offending IP address will be sent to the corner for a timeout, and ALL subsequent requests from that IP will be forbidden until the timeout expires.

When testing, keep in mind that (a) more than brute_force_counter_threshold requests make up a burst, 2 bursts lead to a block, and that block starts after the request that trips the second burst. (If brute_force_counter_threshold = 3, you'll see 8 unblocked attempts before the blocks start).

brute_force_protected_urls allows you to specify multiple vulnerable points

'tx.brute_force_protected_urls=/B /C'

but if you want multiple policies, you'll want a second copy of modsecurity_crs_11_brute_Force.conf with search and replaced variable names.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.