Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Ubuntu 9.10 Apache 2.2.12

Hi Guys,

I'm using a very basic htaccess setup to "protect" a portion of my site (non-critical portion but something I'd like to require basic auth to).

Is there a way to blacklist IPs that fail to provide the appropriate credentials too many times? I'd like to prevent users from having opportunities to guess username/passwords combinations over and over again...

share
add comment

3 Answers

up vote 2 down vote accepted

Do you have root access to the server? There are a few programs that monitor log files for changes, checking for failed auth attempts. After X many failed attempts (user configurable) they then block the originating IP address (temporarily, if desired).

The two that I can remember are:

  • Fail2ban: install with sudo apt-get install fail2ban in Ubuntu then change the /etc/fail2ban/jail.local file (if it doesn't exist, just sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local ). The options in 'jail.local' are pretty self-explatatory but if you want more info you can check out the documentation at http://www.fail2ban.org/wiki/index.php/Main%5FPage

  • BlockHosts: (it's a little older, i'm not sure if it's still up to date) To install, follow the instructions at http://aczoom.com/cms/blockhosts

  • there are probably a whole heap more...

share
    
Awesome. Thanks! This is exactly what I was looking for. –  Mike B Nov 24 '09 at 16:23
add comment

I don't think Apache has any built-in feature that will allow you to do this. Here is something that should work, but is kind of hacky:

  1. Write a cron job that parses the Apache error log, looking for entries that contain "authentication failure"
  2. When a certain IP address has X number of authentication failures, then deny it.
  3. Denying the IP can be accomplished via an Apache access control, or you might be able to use the /etc/hosts.deny file.

You should be able to automate all that via a single cron job.

share
add comment

You may think about a function that add entries to your .htaccess, in php you can do that:


if(is_writable('.htaccess'))
{
       $h = fopen('.htaccess','a+');
       fwrite($h,"\nDeny from: ".$_SERVER['REMOTE_ADDR']);
       fclose($h);
}

share
add comment

This site is currently not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .