1

I am hosting a bunch of PHP web sites on a web server. While I have taken all precautionary mesaures to protect all ports, Port 80 specific attacks continue. I want to ban any IP Address that taken an active interest in any web page(s) more than say 200 in an hour, or 15 in a minute. I am assuming that a human user cannot surf 15 pages in a minute unless he has reasons that are indeed worth suspecting.

Ideally I would like the IP Addresses to be logged into a banned databases, and also have a white listed IP Addresses for those IP Addresses belonging to my client.

Is there any ready tool which does all this. I saw fail2ban and it does not serve the purpose...

  • What about proxies and NAT? All employees of a given office will likely come from the same public IP address. – Julien Jul 21 '11 at 15:19
7

What you need to do is this: 1) Watch the apache logs for access 2) block IP addresses that you qualify on the firewall (via a script).

fail2ban will do what you want, with a little more work than reading the Google search tagline.

  • Also, be sure to white list search engine's bots. You can use a /robots.txt file to tell them what not to index. – Chris Nava Jul 21 '11 at 14:34
1

How about using existing services such as Project Honeypot?

0

This works on my Raspberry Pi running a version of linux and php:

To run iptables from php, add the following to /etc/sudoers www-data ALL=(ALL) NOPASSWD: /sbin/iptables

Some people don't like giving www-data access to iptables. They say it's a security risk. But I think it's ok because they just got banned.

<?php
// Get the ip address of the client.
$remote_addr = $_SERVER['REMOTE_ADDR'];
// Ban them.
if (is_ip($remote_addr)) {
    ban_ip($remote_addr);
    // Save the banned IP address.
    $logfile = '/run/shm/banned.txt';
    file_put_contents($logfile,$remote_addr."\n",FILE_APPEND);
}
// Returns true if $ip is a valid ip address.
function is_ip($ip)
{
    $count = strlen($ip);
    $valid = '0123456789.:';
    for($loop=0;$loop<$count;$loop++) {
        if (strpos($valid,substr($ip,$loop,1))===false) {
            return false;
        }
    }
    return true;
}
// Bans an ip address.
function ban_ip($ip)
{
    $cmd = 'sudo /sbin/iptables -A INPUT -s ' . $ip . ' -j DROP';
    exec($cmd);
    return;
}
?>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.