Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an CentOS/Apache server with a classical .htaccess system of login/password (authtype basic etc...)

I have fail2ban and my iptables are setup to prevent sshd attacks, but I don't know what to do against regular http post requests attempting to force the authentication to my docroot.

AFAIK, (am I wrong?) these attempts do not appear in lastb so fail2ban cannot really do much is the amount of requests is reasonable

share|improve this question

migrated from superuser.com Feb 27 at 3:55

This question came from our site for computer enthusiasts and power users.

    
You wrote about "regular http post requests"... What kind of attack do you mean exactly? Is this about the .htaccess HTTP authentication, or is this about some form-based login? –  oliver Feb 27 at 10:53
    
@oliver yes I am talking about http authentication, "core" –  Sebas Feb 27 at 16:32

2 Answers 2

This is exactly the kind of thing that fail2ban is good at.

Take a look at your error_log and notice the messages that are generated when a login failure occurs.

Now take a look at the filters provided by fail2ban (fail2ban/filter.d). One of them may already be configured to react to the kind of error messages you saw earlier if so then all you need to do is enable it in fail2ban/jail.conf.

If none of the pre supplied filters will do what you want it's generally fairly straightforward to construct your own.

share|improve this answer
    
Thanks, I´ll check that soon –  Sebas Feb 27 at 23:04
    
There's indeed a apache-auth.conf file that may match my needs but a massive grep -r did not show any result for that file. I conclude that it does not appear anywhere. How can I be sure the rules of that file are used? –  Sebas Feb 28 at 4:02
    
@Sebas: I don't know about huge greps - look in the documentation, Like I said you just need to enable it in your jail.conf –  Iain Feb 28 at 7:10

You could also try mod_security. This is a open source rule based webapplication firewall. There are some free default rules provided by SpiderLabs - if they are not enough, you might be able to construct your own.

share|improve this answer
    
If someone is struggling with fail2ban then mod_sec is going to be way to difficult. –  Iain Feb 27 at 9:00
1  
@Iain good point. –  Isaac Feb 28 at 8:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.