5

I have noticed a lot of hackers trying to penetrate my system by making requests for certain paths on my webserver that don't resolve to anything.

Examples: /config/pwtoken_get, /_vti_bin/_vti_aut/author.dll, /xampp/phpmyadmin/index.php, /admin/index.php etc.

What I would like to do is auto-blacklist an ip after it attempts to request such a path. Does anyone have any pointers on how I'd accomplish this?

Thanks!

1
  • 1
    It is more likely these are automated scanners rather than humans, probably unmonitored as well (zombies). This doesn't mean you shouldn't block them, but be aware they are scanning everyone, and have little interest in those sites that aren't exploitable.
    – Paul
    Sep 30, 2012 at 12:52

2 Answers 2

2

You're going to have to tweak the configuration to your needs, but if you're running linux fail2ban should do the trick - you'd need to set it up to watch your apache log file, adjust the regular expressions to fit the particular class of wierdness, and set it to block after a few attempts. I've not used it with apache, but it works wonderfully with other situations.

3

You should be able to do this with fail2ban and a rule like this:

failregex = [[]client (?P<host>\S*)[]] File does not exist: .*/(pwtoken_get|author\.dll|.*admin/index\.php)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .