Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One of our client's PHPBB (surprise, surprise) got hacked. I have taken it down by simply changing the directory name for now however the address website.com/forum/* is still getting hits from unsavory IPs. The server runs Apache, WHM & Cpanel on a CentOS box. I am no expert but would like to automatically block any IP that accesses the directory from ALL http/s requests on the box. Is there a simple solution to this? I do have root shell access.

Any help is appreciated.

SOLVED: Here's how:

  1. SSH to your server
  2. Because i'm in CentOS, cd /tmp
  3. Because i'm in CentOS, rpm -Uvh http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-7.noarch.rpm
  4. yum install fail2ban
  5. Edit /etc/fail2ban/jail.conf and add..

    [apache-banforum]

    enabled = true

    filter = apache-banforum

    logpath = /usr/local/apache/domlogs/website/website.co.uk <-- change to your log file

    maxretry = 1

    bantime = 60000

    action = iptables-multiport[name=BanForum, port="http,https"]

  6. Create a file apache-banforum.conf in /etc/fail2ban/filter.d/ with

    failregex = ^ -."(GET|POST)./forum/.*$

    ignoreregex =

  7. /etc/init.d/fail2ban start

share|improve this question

2 Answers 2

up vote 2 down vote accepted

This would be a job for Fail2Ban. You can use it to scan log files for particular expressions, and block using iptables based on those results.

fail2ban should be available in most distribution repositories, though you may have to add in optional repos.

share|improve this answer
    
This worked although I had to do some prior work before being able to install fail2ban. Thanks. –  beingalex Aug 13 '12 at 13:40

You can create an .htaccess file in the forum dirctory and put these the following lines may help to prtotect that url by accessing.

Order allow,deny Deny from all

share|improve this answer
    
Good idea. I am hoping that by using my firewall the onslaught of hits will start to slow down though. –  beingalex Aug 13 '12 at 13:50
    
Yes firewall is better solution but if there are attacks on different ips and you dont know its better to block the site with .htaccess or some other way and then use the firewall rules, you are also on the right path of fail2ban –  Toqeer Aug 13 '12 at 14:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.