Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to configure Apache to slow down login after failed attempts?

It looks like it is not the default setting as already discussed here.

On the other side it seems to be possible also without adding it to own application logic, on plain Apache, see here, but I found nothing in documentation and discussion???

share|improve this question

I think you could do it with a rule in the mod_security module:

SecFilterSelective VAR VALUE log,pass,pause:5000

But in the end you are better off using fail2ban or something like that to block the offending users.

share|improve this answer
I have the fear that installing any firewall module noticeable slows down the performance too much. Also the configuration of mod_security don't look like it's simple - anyhow, I will try it, thanks! – Achim Mar 17 '12 at 15:05
Its a pity, that there is nothing build in Apache for this simple login failure... – Achim Mar 17 '12 at 15:07
What firewall module? If you mean iptables doesn't have any noticeable overhead and fail2ban will protect you also against other kind of attacks (ssh). – Jure1873 Mar 18 '12 at 18:12

Fail2Ban can look for authentication error in error logs and block bf attempts with iptables

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.