How can I maintain a growing number of blocked IP addresses within Apache

Question

When we see unusual behaviour on our site I am block IP addresses by adding them to the Apache config as so:

<Directory /var/www/html>
  Options FollowSymLinks
  AllowOverride All
  Order allow,deny
  Allow from all
  Deny from 1.1.1.1
  Deny from 2.2.2.2
  # and so on...
</Directory>

This soon becomes unwieldy so is there a standard way of dealing with this? Perhaps moving the list of banned IPs to a file?

Thanks

Answer 1

I'd go with putting all your denies in a file:

# /etc/apache2/banned_ips.conf
Deny from 1.1.1.1
Deny from 2.2.2.2

Then include that in your vhost:

<Directory /var/www/html>
  Options FollowSymLinks
  AllowOverride All
  Order allow,deny
  Allow from all
  include /etc/apache2/banned_ips.conf
  # and so on...
</Directory>

Answer 2

If you are getting a not-so-nice behaviour from those IPs maybe it would be a better idea to block them at firewall level than in Apache, that way you will save Apache some load. One of the bad side of this approach is that will lose those "attacks" from your Apache logs (although that may be a pro instead of a bad thing).

If you are using some kind of firewall it will surely have a easy way of adding bad IPs. If you don't have one in the web servers you should try to install one in you systems: I would recommend shorewall for Linux, or maybe a simple iptables script if you just want to block the access to the web server.

Answer 3

There is a few options here...

mod_security

mod_security for Apache seems like the obvious choice as it can directly integrate with IPTables and block users at the TCP/IP level (rather than user-space).

Have a look here for an explanation http://spamcleaner.org/en/misc/modsec2ipt.html

csf / iptables firewall

I would be inclined to configure a software firewall like CSF - which can add another layer of protection, by rate limiting/blocking abusive IPs.

fail2ban

It takes a bit of configuration, but you can do some really clever things with this. http://www.fail2ban.org/wiki/index.php/Apache

Your current way

Also, to comment on your original post, you can but multiple IPs on one line of the allow/deny directive, see http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html

Finally, if you were to continue to use your method - you can block at the .htaccess level with the same syntax (minus the tags)

Eg.

order allow,deny
allow from all
deny from 1.1.1.1 2.2.2.2 3.3.3.3/24

Your current method seems un-scalable and relies on your ability to judge genuine/malicious traffic - so the automated solutions above would be highly recommended.