Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I notice occasional spikes on my server load and when I check access logs I notice a pattern for some automated forum poster that tries to repeatedly access a comment/reply URL. What would be the best way to throttle /ban these for a few minutes / hours? Can CSF for example do sg like this? I am really looking for a quick and dirty solution.

share|improve this question
3  
fail2ban.org/wiki/index.php/Main_Page –  quanta Aug 22 '12 at 14:22
    
Awesome, looks like the solution. Care to post it as an answer so I can accept it? –  giorgio79 Aug 22 '12 at 15:13

1 Answer 1

up vote 2 down vote accepted

Iptables could be used to that end.

Blocking parallell connections:

iptables -A INPUT -p tcp --syn --dport 80 -m connlimit \
     --connlimit-above 20 -j REJECT --reject-with tcp-reset

Blocking floods (block more than 10 connections per minute) :

iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent \
   --update --seconds 60 --hitcount 10 -j DROP
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.