How to ban potential hacker IP Addresses from Port 80?

Question

I am hosting a bunch of PHP web sites on a web server. While I have taken all precautionary mesaures to protect all ports, Port 80 specific attacks continue. I want to ban any IP Address that taken an active interest in any web page(s) more than say 200 in an hour, or 15 in a minute. I am assuming that a human user cannot surf 15 pages in a minute unless he has reasons that are indeed worth suspecting.

Ideally I would like the IP Addresses to be logged into a banned databases, and also have a white listed IP Addresses for those IP Addresses belonging to my client.

Is there any ready tool which does all this. I saw fail2ban and it does not serve the purpose...

Answer 1

What you need to do is this: 1) Watch the apache logs for access 2) block IP addresses that you qualify on the firewall (via a script).

fail2ban will do what you want, with a little more work than reading the Google search tagline.

Answer 2

How about using existing services such as Project Honeypot?

Answer 3

This works on my Raspberry Pi running a version of linux and php:

To run iptables from php, add the following to /etc/sudoers www-data ALL=(ALL) NOPASSWD: /sbin/iptables

Some people don't like giving www-data access to iptables. They say it's a security risk. But I think it's ok because they just got banned.

<?php
// Get the ip address of the client.
$remote_addr = $_SERVER['REMOTE_ADDR'];
// Ban them.
if (is_ip($remote_addr)) {
    ban_ip($remote_addr);
    // Save the banned IP address.
    $logfile = '/run/shm/banned.txt';
    file_put_contents($logfile,$remote_addr."\n",FILE_APPEND);
}
// Returns true if $ip is a valid ip address.
function is_ip($ip)
{
    $count = strlen($ip);
    $valid = '0123456789.:';
    for($loop=0;$loop<$count;$loop++) {
        if (strpos($valid,substr($ip,$loop,1))===false) {
            return false;
        }
    }
    return true;
}
// Bans an ip address.
function ban_ip($ip)
{
    $cmd = 'sudo /sbin/iptables -A INPUT -s ' . $ip . ' -j DROP';
    exec($cmd);
    return;
}
?>