Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Im trying to keep away some attackers that try to exploit XSS vulnerabilities from my website, I have found that most of the malicious attempts start with a classic "alert(document.cookie);\" test. The site is not vulnerable to XSS but I want to block the offending IP addresses before they found a real vulnerability, also, to keep the logs clean.

My first thought is to have a script constantly checking in the Apache logs all IP addresses that start with that probe and send those addresses to an iptables drop rule. With something like this:

cat /var/log/httpd/-access_log | grep "alert(document.cookie);" | awk '{print $1}' | uniq

Why would be an effective way to send the output of that command to iptables?

Thanks in advance for any input!

share|improve this question
1  
In case you really wanted to write your own script, iplock may interest you. It simplifies the iptable handling by hiding the nitty gritty and allowing you to run your script as a normal user (otherwise the script needs to run as root...) snapwebsites.org/project/iplock –  Alexis Wilke Nov 3 '13 at 3:48

1 Answer 1

up vote 5 down vote accepted

You'll be happy to know that you don't have to write a program; fail2ban already does this.

share|improve this answer
    
They have a typo for "courier"... Was fail2ban checking apache2 logs for a long time? I thought it was only for emails... –  Alexis Wilke Nov 3 '13 at 3:46
    
@AlexisWilke fail2ban can check anything you can write a regex for. I use it in a similar circumstance to block bots which hammer a Drupal registration page. Oh, and that's a wiki; you can edit it and fix typos... –  Michael Hampton Nov 3 '13 at 3:49
    
Their wiki is locked down... I also have a Drupal site and just added a script to get the reCAPTCHA failed attempt from the database to my firewall. That is working. I saw 36 blocks in the last 40 minutes and my server load is 0.04 instead of 0.4! –  Alexis Wilke Nov 3 '13 at 4:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.