Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way to configure Apache to slow down login after failed attempts?

It looks like it is not the default setting as already discussed here.

On the other side it seems to be possible also without adding it to own application logic, on plain Apache, see here, but I found nothing in documentation and discussion???

share|improve this question
add comment

2 Answers

I think you could do it with a rule in the mod_security module:

SecFilterSelective VAR VALUE log,pass,pause:5000

But in the end you are better off using fail2ban or something like that to block the offending users.

share|improve this answer
    
I have the fear that installing any firewall module noticeable slows down the performance too much. Also the configuration of mod_security don't look like it's simple - anyhow, I will try it, thanks! –  Achim Mar 17 '12 at 15:05
    
Its a pity, that there is nothing build in Apache for this simple login failure... –  Achim Mar 17 '12 at 15:07
    
What firewall module? If you mean iptables doesn't have any noticeable overhead and fail2ban will protect you also against other kind of attacks (ssh). –  Jure1873 Mar 18 '12 at 18:12
add comment

Fail2Ban can look for authentication error in error logs and block bf attempts with iptables

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.