Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ubuntu 9.10 Apache 2.2.12

Hi Guys,

I'm using a very basic htaccess setup to "protect" a portion of my site (non-critical portion but something I'd like to require basic auth to).

Is there a way to blacklist IPs that fail to provide the appropriate credentials too many times? I'd like to prevent users from having opportunities to guess username/passwords combinations over and over again...

share|improve this question
up vote 2 down vote accepted

Do you have root access to the server? There are a few programs that monitor log files for changes, checking for failed auth attempts. After X many failed attempts (user configurable) they then block the originating IP address (temporarily, if desired).

The two that I can remember are:

  • Fail2ban: install with sudo apt-get install fail2ban in Ubuntu then change the /etc/fail2ban/jail.local file (if it doesn't exist, just sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local ). The options in 'jail.local' are pretty self-explatatory but if you want more info you can check out the documentation at

  • BlockHosts: (it's a little older, i'm not sure if it's still up to date) To install, follow the instructions at

  • there are probably a whole heap more...

share|improve this answer
Awesome. Thanks! This is exactly what I was looking for. – Mike B Nov 24 '09 at 16:23

I don't think Apache has any built-in feature that will allow you to do this. Here is something that should work, but is kind of hacky:

  1. Write a cron job that parses the Apache error log, looking for entries that contain "authentication failure"
  2. When a certain IP address has X number of authentication failures, then deny it.
  3. Denying the IP can be accomplished via an Apache access control, or you might be able to use the /etc/hosts.deny file.

You should be able to automate all that via a single cron job.

share|improve this answer

You may think about a function that add entries to your .htaccess, in php you can do that:

       $h = fopen('.htaccess','a+');
       fwrite($h,"\nDeny from: ".$_SERVER['REMOTE_ADDR']);

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.