1

Ok another noob questions here. I have serveral IP's probing my server for phpmyadmin and other administrator stuff, looks like they're looking for something to hack, but honestly I don't care who they are, I just want to block them. How can i block these IPs? Is it in the .htaccess? I have all the auth modules in apache and they are activated.

Improve this question

3 Answers 3

Reset to default
4

The best way to do this with apache is with the access control module. Basically, just put something like this into your .htaccess

 Deny from 10.252.46.165

More information on it can be found here.

However, that is not necessarily the best way to do it, because Apache is still handling the request. You can actually block all incoming traffic from certain IPs before they even reach Apache, or any other services. The downside with this is that you need to have root access to your server. Information on that can be found here.

Improve this answer
2
  • It is my own server, i do have root access. Thanks, this should do it.
    – alpha1
    Aug 28, 2009 at 0:34
  • You might also want to look into something like Fail2Ban or DenyHosts, which can automatically set the firewall to block IP addresses that exhibit suspicious behavior. Or mod_security for something similar at the Apache level.
    – David Z
    Aug 28, 2009 at 4:47
1

If there a firewall between your server and the Internet? That would be the best place to block them. Blocking the IPs from accessing your server on the server will protect you from brute force attacks, but not from a DDoS attack, as they are still making requests that your server has to reject.

If you have to do it locally, I'd say do it in iptables.

Improve this answer
2
  • Only a cheapie router, which can't block incoming IPs
    – alpha1
    Aug 28, 2009 at 0:32
  • alpha1: If you are using Linux, iptables is the built in firewall for the Linux box and I would opt for that as well.
    – Kyle Brandt
    Aug 28, 2009 at 11:17
1

Probably a more security-minded approach would be that you block everyone for sensitive URL's (PHPMyAdmin etc.), and only allow a couple of IP addresses in, so you can still access those services. Example:

<Location /sensitive/url>
    Order allow,deny
    Allow from 127.0.0.1 a.b.c.d your.manager.hosts.address
    Deny from all
</Location>

Of course it depends on the situation if it suits your needs or not.

You can also combine this with HTTP authentication, probably this method is more flexible. If you use Order and Require with

Satisfy Any

in a <Location /> or a <Directory /> block, then you can access this resource from everywhere. In this case, if you come from one of the IP addresses defined in the Allow line, you can access the URL as usual. However, if you come from another host, the webserver asks for username and password.

I hope that helped.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .