In an effort to harden a public-facing webserver, my colleague and I came up with a plan that involves getting Apache to "Black-hole" certain requests. For instance, requests for phpmyadmin (which isn't running) or other obvious hacking/malicious attempts, we want apache to not even respond.

I know Apache can be made to send various errors or respond with empty data using mod_rewrite, but I want to send them as little as possible, so ideally...Nothing.

  • 1
    You might also want to check out fail2ban. fail2ban.org/wiki/index.php/Main_Page Mar 6, 2014 at 19:21
  • 1
    I will look into fail2ban, but our servers are behind a cloud load balancer, and the ip-address reported in apache is sometimes the internal IP of the load balancer itself. I've attempted to work with our provider, but without dedicated hardware, we are limited Mar 6, 2014 at 19:49
  • 1
    As per answer elsewhere, your proposal is a bit silly. Using Fail2ban is a very effective tool and appropriate for the scenario you describe. Proxies and load balancers which can't make the real client address visible to a server are exceedingly rare. If your provider doesn't how to implement this then its a pretty good litmus test of their ability to solve other problems.
    – symcbean
    Mar 6, 2014 at 23:20

2 Answers 2


Large sites that need to protect their application use something called a Network IDS (Intrusion Detection System, also known as an IPS (Intrusion Prevention System) which can reject packets based on certain criteria (Source IP, behavior, fingerprint, etc). Many IDSes will allow you to drop a packet on the floor (e.g. no response at all), terminate a TCP/UDP session immediately, add you to a blackhole list, direct the session to a honeypot, etc. This topic can be extremely complicated and very interesting: Cisco and others sell expensive appliances to to this for you, some security admins spend their career doing this, etc. Large sites like Facebook, Twitter and Google have extremely complicated IDSes which do very interesting things.

An IDS is a device on the network level, not the application level. An application-level IDS is still subject to a number of other attacks such as DDOS, TCP & IP-level attacks, etc.

However, not everyone can implement a network IDS. At the Apache level, many people use mod_security as an Application-level IDS. By default, mod_security ships with the ability to protect a site from a number of common attacks already, and can be customized to do specific things that you want. mod_security can be run in 'Permissive mode' where it will warn about attacks and print what it thinks it should do, and 'blocking mode' where it will actively block perceived attacks. From their FAQ:


ModSecurity™is an open source, free web application firewall (WAF) Apache module. With over 70% of all attacks now carried out over the web application level, organizations need all the help they can get in making their systems secure. WAFs are deployed to establish an external security layer that increases security, detects and prevents attacks before they reach web applications. It provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring and real-time analysis with little or no changes to existing infrastructure.

Dropping a session at this level in the OSI stack is a bit clumsy, but some people do something close. See How to drop all requests using mod_security

mod_security is not always an easy prospect, but mod_rewrite can also get very complicated. mod_security does have a lot of documentation and experienced community of users to draw from.

  • Using mod_security opens up a whole new world for pain.
    – user9517
    Mar 6, 2014 at 19:38
  • Indeed. All features add complexity and pain. Mar 6, 2014 at 19:39
  • From first glance, it doesn't look like I want to try to marry mod_rewrite (to catch a request) and mod_security (to drop it)...Do I? I'm definitely going to read more about this from every angle, though Mar 6, 2014 at 19:47
  • You would probably use mod_security instead of mod_rewrite. Mar 6, 2014 at 20:14

What are you trying to achieve here? Inconvenience people who might be attacking your server or protect your server? The 2 are not compatible.

Apache cannot interfere with the network stack to not make any response; that means you've got to hold the connection open and that means you've artificially kept a process spinning for much longer than required. This then makes a really effective asset for anyone wanting to carry out a DOS of your site - they just hit you with 500 or so requests for phpmyadmin and every slot on your server is tied up.

You could redirect them to a black hole address - but then you've got the expense of maintaining a static IP address which doesn't do anything.

Further, do you believe that script kiddies know how to configure a short timeout on their clients? You've only defeated a single request by implementing this.

A better solution is to trap and log these requests and use the log (or just filter your error_log) to feed fail2ban. That way you can implement a block at the firewall which will keep them out before they are able to map out what software you do have installed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .