1

Ubuntu 9.10 Apache 2.2.12

Hi Guys,

I'm using a very basic htaccess setup to "protect" a portion of my site (non-critical portion but something I'd like to require basic auth to).

Is there a way to blacklist IPs that fail to provide the appropriate credentials too many times? I'd like to prevent users from having opportunities to guess username/passwords combinations over and over again...

2

Do you have root access to the server? There are a few programs that monitor log files for changes, checking for failed auth attempts. After X many failed attempts (user configurable) they then block the originating IP address (temporarily, if desired).

The two that I can remember are:

  • Fail2ban: install with sudo apt-get install fail2ban in Ubuntu then change the /etc/fail2ban/jail.local file (if it doesn't exist, just sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local ). The options in 'jail.local' are pretty self-explatatory but if you want more info you can check out the documentation at http://www.fail2ban.org/wiki/index.php/Main_Page

  • BlockHosts: (it's a little older, i'm not sure if it's still up to date) To install, follow the instructions at http://aczoom.com/cms/blockhosts

  • there are probably a whole heap more...

  • Awesome. Thanks! This is exactly what I was looking for. – Mike B Nov 24 '09 at 16:23
  • With fail2ban, it is recommended to overwrite only the settings we need instead of copying the entire jail.conf to jail.local: "In order for these two files to operate together successfully, it is best to only include the settings you wish to override in the jail.local file" digitalocean.com/community/tutorials/… – baptx Dec 4 '17 at 19:00
2

I don't think Apache has any built-in feature that will allow you to do this. Here is something that should work, but is kind of hacky:

  1. Write a cron job that parses the Apache error log, looking for entries that contain "authentication failure"
  2. When a certain IP address has X number of authentication failures, then deny it.
  3. Denying the IP can be accomplished via an Apache access control, or you might be able to use the /etc/hosts.deny file.

You should be able to automate all that via a single cron job.

2

You may think about a function that add entries to your .htaccess, in php you can do that:


if(is_writable('.htaccess'))
{
       $h = fopen('.htaccess','a+');
       fwrite($h,"\nDeny from: ".$_SERVER['REMOTE_ADDR']);
       fclose($h);
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.