0

I am trying to figure out how to write a ModSecurity rule that would block the IP from the server for a period of time when that IP is generating a certain amount of 403 errors, and I am struggling with writing the rule. Does anyone have any ideas of what this rule would look like?  

Improve this question
1
  • I recommend you take a look at the OWASP ModSecurity Core Rule Set (CRS) to get an idea for how rules are written. Combined with the ModSecurity documentation, you should be able to figure out how to create variables, how to increment the variable per 403 response, and how to block the IP once that variable hits your desired threshold.
    – slightly_toasted
    Jan 10, 2023 at 23:50

1 Answer 1

Reset to default
0

Fail2Ban is the correct tool for this. It can read ModSecurity logs and ban IP addresses based on them. It comes with a filter for ModSecurity 2 that can be enabled in, e.g., /etc/fail2ban/jail.d/apache.conf:

[apache-modsecurity]
enabled = true

You might want to adjust the maxretry as it defaults to 2 which seems pretty aggressive.

Improve this answer
3
  • Does fail2ban work on windows ?
    – Khurshid Alam
    Jan 15 at 7:30
  • How to do that on windows with IIS ?
    – Khurshid Alam
    Jan 15 at 7:37
  • @KhurshidAlam Let me google that for you! With Fail2Ban for Windows the first results says: "Fail2ban is not available for Windows but there are some alternatives that runs on Windows with similar functionality."
    – Esa Jokinen
    Jan 15 at 14:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .