Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an apache2 server with several sites enabled on it, including the default one (000default). The default server is catching lots of spammy requests that are doing nothing but consume bandwidth and fill up the log file.

What would be a minimal virtual host config that would drop all requests that hit the default site?

This is what I have so far using mod_security, but it seems to do nothing but respond with a 403 for all requests:

<VirtualHost *:80>
    ServerName default.only
    SecRuleEngine On
    SecAction "drop,phase:1"
</VirtualHost>
share|improve this question
    
Try SecRuleEngine off for other vhosts? –  slowpoison Jun 22 '12 at 23:14
    
thanks, but that didn't seem to make any difference –  izb Jun 22 '12 at 23:16

3 Answers 3

Apache has to handle the request in some way, it can't just ignore them. Responding with 403 Forbidden is as close as you get.

share|improve this answer
    
You can drop connections without handling them using the mod_security module. It's the configuration of that module I'm having problems with. –  izb Jun 23 '12 at 10:54

The mod_security action deny will produce a 403 response whereas drop will immediately close the connection. From the manual:

drop

Description: Immediately initiate a "connection close" action to tear down the TCP connection by sending a FIN packet.

Action Group: Disruptive

Example: The following example initiates an IP collection for tracking Basic Authentication attempts. If the client goes over the threshold of more than 25 attempts in 2 minutes, it will DROP subsequent connections.

SecAction initcol:ip=%{REMOTE_ADDR},nolog
SecRule ARGS:login "!^$" \
    nolog,phase:1,setvar:ip.auth_attempt=+1,deprecatevar:ip.auth_attempt=20/120
SecRule IP:AUTH_ATTEMPT "@gt 25" \
    log,drop,phase:1,msg:'Possible Brute Force Attack"

Note

This action is extremely useful when responding to both Brute Force and Denial of Service attacks in that, in both cases, you want to minimize both the network bandwidth and the data returned to the client. This action causes error message to appear in the log "(9)Bad file descriptor: core_output_filter: writing data to the network"

share|improve this answer
up vote 1 down vote accepted

I managed to fix this with the following config:

<VirtualHost *:80>
    ServerName default.only

    SecRuleEngine On
    SecRule REMOTE_ADDR "^\d" drop,phase:1
</VirtualHost>
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.