0

i like to block out some bot trying to do bad stuff to my web-applications. a daily cronjobs extends my block.conf, containing a lof of deny a.b.c.d lines. before the cronjob runs at 4am and after some host ir recognized as bad i look them up in the database and stop processing and response with an empty http-body, but i like to be able to to response with an empty response as well here, like i do with the one that matches de rules from the block.conf.

is there any way to do it? like sending a header or anything? thanks

Improve this question
1

1 Answer 1

Reset to default
0

I would recommend you to have a look at naxsi which is a Web Application Firewall Module for nginx that you can configure using your own rules to exactly catch certain bot scanning patterns.

Additionaly you could install fail2ban and configure it to work with naxsi and automatically banning certain patterns. https://code.google.com/p/naxsi/wiki/NaxsiFail2ban

The good thing is that fail2ban blocks hosts on network/iptabels level instead of just denying request by the webserver. So it's more restrictive and eventually more secure as the bad ips can't access your webserver anymore at all.

Improve this answer
2
  • sadly fail2ban isn't an option since my application runs inside vserver and docker containers so iptables is none of the bussiness we can deal with. - iam pretty fine with the block ing setup where nginx blocks the bad guys, bots searching for unsecured guestbook-forms are not a security-problem for me, just a performance-problem.
    – Dirk Heilig
    Mar 30, 2014 at 20:35
  • You still might want to look at naxsi if you have the chance to use it. Even without fail2ban/iptables it's only server side blocking then but gives you way more possibilities due to the rules you can use.
    – binaryanomaly
    Mar 30, 2014 at 20:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .