Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I have a simple Apache webserver setup and basic IP tables (ufw) for a development server. In my logs I see lines like this:

[Fri May 16 10:10:36.258369 2014] [:error] [pid 15926] [client] script '/var/www/html/wp-login.php' not found or unable to stat

I am not running WordPress at all, and I realize this is a very minor attempt at a hack (there are much more sophisticated attacks against Apache out there). However I would like to automatically block this IP address (temporarily) without installing an IDS/IPS such as Snort.

I am just looking for a simple way to block an address that tries to connect to wp-admin or wp-login. Is there an Apache module that would handle something like this?

share|improve this question

marked as duplicate by Iain, Jacob, Andrew B, mdpc, dawud May 17 '14 at 15:10

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

6 – ceejayoz May 16 '14 at 17:32
Have you considered the DoS potential such automated blocking has, when attacks and legitimate requests originate from the same IP? Are you sure none of your legitimate users have to access your site through a CGN? – kasperd May 16 '14 at 17:33
@ceejayoz Ah, that does exactly what I was looking for, thank you. I apologize if the question seemed easy to answer with a little research, however when trying to google it, all I was finding was ways to secure wordpress (obviously I wasn't asking google the right question). – Aaron Murray May 16 '14 at 17:36
@kasperd - it's a development server ;) – Iain May 16 '14 at 17:41
@kasperd I see your point, and a very good one at that. Of course the blocks are temporary (say 15 minutes), and only in place to deter further hacking attempts. The user base is for beta testing functionality. (of course once completion of beta testing, the app is moved into a production / properly secured -by people who know more about security than me- environment) – Aaron Murray May 16 '14 at 17:45

While you are clearly asking for a solution to block IP addresses, I don't think that is a good solution.

The reason being that these attempts you see are coming from various IP addresses most likely controlled by one master system. That is simply the nature of how DDoS & hacking attempts occur nowadays.

Instead, you should look into implementing ModSecurity. It's an Apache module that acts as a web service level firewall. It analyzes all web traffic coming to your site, and if it detects known aberrant behavior, access us blocked dead in it's tracks by a "403: Forbidden" response.

Now the slightly negative side is that MidSecurity has dozens of default rule sets that work well, but might cause false positives. So when you implement it you will most likely need to tweak it for the first few weeks.

But the net result is after this "getting to know you" period you will have a tool that heuristically protects your site from known bad behavior. And not just keep a list of IP addresses.

share|improve this answer
I do in fact have ModSecurity installed and enabled already, as well the system is kept patched / security updates installed daily. I am (obviously) not a security expert, nor do I think that the server requires a tremendous amount of security due to its nature. I am just looking for that extra bit of security to deter those 'script kiddies'. Real hackers I am sure would find workarounds, but I doubt they would bother due to the lack of useful data on or accessible by this server. I will upvote as is also good information. – Aaron Murray May 16 '14 at 22:59
@AaronMurray “…but I doubt they would bother due to the lack of useful data on or accessible by this server. I will up vote as is also good information.” Well, you misunderstand what these hacking attempts try to achieve. They don’t want your data. These things are really never targeted attacks. They want a server on the Internet they can infect & use as a node in malware or phishing. – JakeGould May 16 '14 at 23:07

I wouldn't recommend trying to do so automatically, I would recommend manually blocking the IP . The only automated system I would do would be a script or something similar that parses your logs for similar errors.

To block an IP with ufw
sudo ufw deny from <ip address>

with iptables
sudo iptables -I INPUT -s <ip address> -j DROP

share|improve this answer
I understand your given recommendation, however this does not suit my needs as it would mean babysitting my logs. The question states I need something automated (of which fail2ban noted by @ceejayoz above appears to be a simple solution to my question) – Aaron Murray May 16 '14 at 17:54
@Siggy Automated systems exist. Doing what you propose manually is a hopeless task at best. Should the original poster sit on his server 24/7/365 just to add rules? – JakeGould May 16 '14 at 19:24

The solution that works for me is fail2ban as noted in comment by @ceejayoz

@iain - This is in fact duplicate - thank you for pointing that out.

share|improve this answer
This is not an answer. If an answer works for you mark it as such or leave a comment. But this should be removed. – JakeGould May 16 '14 at 19:16
@JakeGould There's no other answer that I can see that advises to use fail2ban. This answer looks fine to me. – Michael Hampton May 16 '14 at 19:34
@MichaelHampton This "answer" is the original poster answering their own question by simply regurgitating what ceejayoz recommends it in the comments to the question. The user ceejayoz should post a formal answer & this should be deleted. – JakeGould May 16 '14 at 19:38
@MichaelHampton unfortunately the original person to answer it (@ceejayoz) posted the answer as a comment, so I was just repeating it in answer form so that the question could be closed. Can you tell me how else to close a question without creating an answer? – Aaron Murray May 16 '14 at 22:41
I can just delete the question if you would like. – Michael Hampton May 16 '14 at 22:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.