Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Ubuntu 9.10 Apache 2.2.12

Hi Guys,

I'm using a very basic htaccess setup to "protect" a portion of my site (non-critical portion but something I'd like to require basic auth to).

Is there a way to blacklist IPs that fail to provide the appropriate credentials too many times? I'd like to prevent users from having opportunities to guess username/passwords combinations over and over again...

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Do you have root access to the server? There are a few programs that monitor log files for changes, checking for failed auth attempts. After X many failed attempts (user configurable) they then block the originating IP address (temporarily, if desired).

The two that I can remember are:

  • Fail2ban: install with sudo apt-get install fail2ban in Ubuntu then change the /etc/fail2ban/jail.local file (if it doesn't exist, just sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local ). The options in 'jail.local' are pretty self-explatatory but if you want more info you can check out the documentation at http://www.fail2ban.org/wiki/index.php/Main%5FPage

  • BlockHosts: (it's a little older, i'm not sure if it's still up to date) To install, follow the instructions at http://aczoom.com/cms/blockhosts

  • there are probably a whole heap more...

share|improve this answer
    
Awesome. Thanks! This is exactly what I was looking for. –  Mike B Nov 24 '09 at 16:23

I don't think Apache has any built-in feature that will allow you to do this. Here is something that should work, but is kind of hacky:

  1. Write a cron job that parses the Apache error log, looking for entries that contain "authentication failure"
  2. When a certain IP address has X number of authentication failures, then deny it.
  3. Denying the IP can be accomplished via an Apache access control, or you might be able to use the /etc/hosts.deny file.

You should be able to automate all that via a single cron job.

share|improve this answer

You may think about a function that add entries to your .htaccess, in php you can do that:


if(is_writable('.htaccess'))
{
       $h = fopen('.htaccess','a+');
       fwrite($h,"\nDeny from: ".$_SERVER['REMOTE_ADDR']);
       fclose($h);
}

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.