2

Currently I'm using Blockhosts & mod_evasive to "manage" minor attacks & spurious requests, I'm wondering if there is something better/more effective out there. Something that behaves like mod_evasive, monitoring requests as they come in but has the ability to control what gets blocked using keywords or regex.

For example, anytime anyone requests something like "../etc/passwd" - I would like to drop that IP address for a few days. I've looked at fail2ban as well, but it does the same thing as blockhosts, monitors log files. not exactly what I am looking for.

Anyway, the server is CentOS running Apache 2.2, in a paralells virtual host container & hosting about 100 sites, so I only have web access to the virtual machines host servers firewall & trying to jam in rewrite rules in each domain's htaccess will not be maintainable.

Any suggestions?

Improve this question

1 Answer 1

Reset to default
5

The module you are looking for is mod_security. It lets you build custom rulesets to block types of attacks. Installing mod_security is not enough you also need to get a good ruleset.

At a larger scale, I would look into Cloudflare. They are a live updating service that performs the same functions.

Improve this answer
4
  • 2
    +1 Here are links for mod_security and a good mod_security ruleset.
    – xofer
    Sep 11, 2011 at 16:44
  • Just scanning the docs now, what sort of memory footprint does it have? I'm running apache as prefork, so each process will use more ram. I thought cloudflare was just a caching utility [and not free] - I'll have to dig more to see if it can be used without caching features & over all sites [as I need something maintainable]
    – Sean Kimball
    Sep 11, 2011 at 16:55
  • @fuscata, thanks for the ruleset link. Owasp does good stuff. At the last place I work we paid for a commercial ruleset. Not going to link to that one here. Sean - mod_security adds overhead, but as long as your rules are tightly defined its not brutal. Cloudflare's basic service is free, it was started as a security tool, not a CDN replacement.
    – n8whnp
    Sep 12, 2011 at 4:33
  • Looking at mod_security - it looks like it needs to be compiled with apache - is there no option to load it dynamically?
    – Sean Kimball
    Sep 13, 2011 at 1:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.