3

One of our primary webservers, which runs Apache on Ubuntu, is coming under attack from heaps of referrer SPAM requests lately. There's enough of this that it is really sucking up our internet bandwidth.

How do others deal with this and block it?

Update: OK, thanks to Kevin, I've installed fail2ban and am seeing what I can filter with it. Any suggestions still gratefully accepted though ;-)

2 Answers 2

3

There's a really comprehensive .htaccess file here that will deny the majority of those bad bots for you.

Just edit the last line to 'forbid', rather than sending them to the honeypot script...

e.g.: change last line to:

RewriteRule ^.* - [F]

EDIT: Yes "Mozilla/4.0.." spoofing is annoying. If you can't block by user-agent header, then IP addresses have to be the way to go.

For an automated self maintaining solution, have a look at project honeypot!

/ Richy

2
  • Thanks, that's a useful file to add. Although I do notice that most of them are spoofing "Mozilla/4.0...."
    – Glenn
    Jun 1, 2009 at 6:41
  • 1
    Then project honeypot may help. I've edited the answer to provide info on this.
    – Rich
    Jun 1, 2009 at 8:31
2

Is there anything you can use in the referrer request that you could feed to fail2ban?

1
  • OK, I've found the website for it and am reading through the documentation. Will try it out as a first step...
    – Glenn
    Jun 1, 2009 at 5:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .