I'm trying to get mod_evasive to fire off a script to add an iptables rule to deny the offending host. I've tried the suggestions from both answers here but I still can't get it working. Apart from the post that's linked, I'm trying to run a script as outlined in this article.
My Apache config has this
DOSSystemCommand "sudo -u root /root/scripts/ban_ip.sh %s"
The script has this
#!/bin/sh IP=$1 IPTABLES=/sbin/iptables $IPTABLES -A banned -s $IP -p TCP -j DROP echo "$IPTABLES -D banned -s $IP -p TCP -j DROP" | at now + 5 minutes
I've created a 'banned' chain (I've also just tried to add it to the INPUT chain to no avail)
My /etc/sudoers looks like this:
apache ALL=(root) NOPASSWD: /root/scripts/ban_ip.sh *
I've disabled SELinux to make sure it's not getting in the way. I can
su apache --shell=/bin/bash and run
sudo /root/scripts/ban_ip.sh 10.10.10.10 and it works just fine.
But when a source gets flagged as malicious in mod_evasion, it denies the host with 403s but it never runs the script, so I'm not really gaining any advantage here.
What else can I try to get this working?