0

I'm not doing anything fancy. I'm just using Apache2 access control to password protect a directory.

I thought it would be smart if Apache would limit how frequently users can attempt to authenticate username and password from a given IP. It would be a cheap way to thwart brute force password attempts without DoSing legitimate user login attempts.

I searched and couldn't find anything specific to this and I was surprised. Is there a way to do it? Is there something better?

1 Answer 1

0

This blog post indicates you can do it with mod_security using something like the following:

SecRuleEngine On

<LocationMatch "^/somepath">
  SecAction initcol:ip=%{REMOTE_ADDR},pass,nolog
  SecAction "phase:5,deprecatevar:ip.somepathcounter=1/1,pass,nolog"
  SecRule IP:SOMEPATHCOUNTER "@gt 60" "phase:2,pause:300,deny,status:509,setenv:RATELIMITED,skip:1,nolog"
  SecAction "phase:2,pass,setvar:ip.somepathcounter=+1,nolog"
  Header always set Retry-After "10" env=RATELIMITED
</LocationMatch>

ErrorDocument 509 "Rate Limit Exceeded"

More discussion on this answer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .