Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 3 down vote favorite

we're using mod_security and we have currently issues with some bots.

i would like to block ips, that visited 404 pages more than 10 times in a minute.

How can this be done? How can i poll the 404 return codes?

how can i count the error 404 return codes in phase 3?

"RESPONSE_STATUS may not work as expected in embedded mode, as Apache sometimes handles certain requests differently, and without invoking ModSecurity (all other modules)."

How can i get the RESPONSE_STATUS every time for sure? phase 5?

share|improve this question

1 Answer

up vote 2 down vote accepted

Mod_security should already come with some scripts, provided by the OWASP project, which block robots. Have you checked them out? You will have to enable modsecurity_crs_35_bad_robots.conf. You can download the file from the OWASP project site:

https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project

Instructions can be found there as well.

From README:

== base_rules/modsecurity_crs_35_bad_robots.conf ==  Detection of Malicious Robots
    - Unique request attributes: User-Agent header, URL, Headers
    - RBL Check of IP addresses
    - Detection of security scanners
    - Blocking can confuse security testing software (WAFW00f)
share|improve this answer
thank you, we're already using crs. the problem is, that the bots are visiting from different IPs at 10 req/sec and cause a lot of error 404. how can i count the error 404 return codes in phase 3? – JMW Mar 30 '12 at 7:07
thanks for answering. your answer didn't solve my problem, but since you were the only one that answered, i'll accept it. :-) – JMW May 11 '12 at 8:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.