Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have noticed a lot of hackers trying to penetrate my system by making requests for certain paths on my webserver that don't resolve to anything.

Examples: /config/pwtoken_get, /_vti_bin/_vti_aut/author.dll, /xampp/phpmyadmin/index.php, /admin/index.php etc.

What I would like to do is auto-blacklist an ip after it attempts to request such a path. Does anyone have any pointers on how I'd accomplish this?


share|improve this question
It is more likely these are automated scanners rather than humans, probably unmonitored as well (zombies). This doesn't mean you shouldn't block them, but be aware they are scanning everyone, and have little interest in those sites that aren't exploitable. – Paul Sep 30 '12 at 12:52
up vote 2 down vote accepted

You're going to have to tweak the configuration to your needs, but if you're running linux fail2ban should do the trick - you'd need to set it up to watch your apache log file, adjust the regular expressions to fit the particular class of wierdness, and set it to block after a few attempts. I've not used it with apache, but it works wonderfully with other situations.

share|improve this answer

You should be able to do this with fail2ban and a rule like this:

failregex = [[]client (?P<host>\S*)[]] File does not exist: .*/(pwtoken_get|author\.dll|.*admin/index\.php)
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .