5

I have an CentOS/Apache server with a classical .htaccess system of login/password (authtype basic etc...)

I have fail2ban and my iptables are setup to prevent sshd attacks, but I don't know what to do against regular http post requests attempting to force the authentication to my docroot.

AFAIK, (am I wrong?) these attempts do not appear in lastb so fail2ban cannot really do much is the amount of requests is reasonable

|improve this question
  • You wrote about "regular http post requests"... What kind of attack do you mean exactly? Is this about the .htaccess HTTP authentication, or is this about some form-based login? – oliver Feb 27 '14 at 10:53
  • @oliver yes I am talking about http authentication, "core" – Sebas Feb 27 '14 at 16:32
4

This is exactly the kind of thing that fail2ban is good at.

Take a look at your error_log and notice the messages that are generated when a login failure occurs.

Now take a look at the filters provided by fail2ban (fail2ban/filter.d). One of them may already be configured to react to the kind of error messages you saw earlier if so then all you need to do is enable it in fail2ban/jail.conf.

If none of the pre supplied filters will do what you want it's generally fairly straightforward to construct your own.

|improve this answer
  • There's indeed a apache-auth.conf file that may match my needs but a massive grep -r did not show any result for that file. I conclude that it does not appear anywhere. How can I be sure the rules of that file are used? – Sebas Feb 28 '14 at 4:02
  • @Sebas: I don't know about huge greps - look in the documentation, Like I said you just need to enable it in your jail.conf – user9517 supports GoFundMonica Feb 28 '14 at 7:10
2

You could also try mod_security. This is a open source rule based webapplication firewall. There are some free default rules provided by SpiderLabs - if they are not enough, you might be able to construct your own.

|improve this answer
  • If someone is struggling with fail2ban then mod_sec is going to be way to difficult. – user9517 supports GoFundMonica Feb 27 '14 at 9:00
  • 1
    @Iain good point. – Isaac Feb 28 '14 at 8:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.