Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have noticed a lot of hackers trying to penetrate my system by making requests for certain paths on my webserver that don't resolve to anything.

Examples: /config/pwtoken_get, /_vti_bin/_vti_aut/author.dll, /xampp/phpmyadmin/index.php, /admin/index.php etc.

What I would like to do is auto-blacklist an ip after it attempts to request such a path. Does anyone have any pointers on how I'd accomplish this?

Thanks!

share|improve this question
1  
It is more likely these are automated scanners rather than humans, probably unmonitored as well (zombies). This doesn't mean you shouldn't block them, but be aware they are scanning everyone, and have little interest in those sites that aren't exploitable. –  Paul Sep 30 '12 at 12:52

2 Answers 2

up vote 2 down vote accepted

You're going to have to tweak the configuration to your needs, but if you're running linux fail2ban should do the trick - you'd need to set it up to watch your apache log file, adjust the regular expressions to fit the particular class of wierdness, and set it to block after a few attempts. I've not used it with apache, but it works wonderfully with other situations.

share|improve this answer

You should be able to do this with fail2ban and a rule like this:

failregex = [[]client (?P<host>\S*)[]] File does not exist: .*/(pwtoken_get|author\.dll|.*admin/index\.php)
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.