1

getting a bunch of bogus requests hitting my server.

would like to block any requests that include http:// in it.

example:

domain.com/forum/function/component.php=http://bogusdomain.gov.ve/images/foo.txt

I thought

RewriteRule ^(.*=http://) - [F]

would do it, but it doesn't seem to work.

any suggestions?

jimg
  • 262
  • 4
  • 15

2 Answers2

1

If you're worried about such requests you'd better tackle the source of the problem, i.e. turn allow_url_fopen off in PHP etc.

As for the rewrite rule... do other rewriterules work? (i.e. is the engine enabled?) ^.=http://.$ should match I guess, no need for the parentheses since you're not reusing the match

Marki
  • 2,854
  • 3
  • 28
  • 45
  • It's not a matter of worrying about the requests - they are coming in nonstop. Can't address the source of the problem - this is a bunch of bots scouring the web looking for conditions. Sure, the condition is closed (was never open on my server) but I'd rather cut off all requests of this nature at the apache level rather than taxing the server with unnecessary php cycles. and yes, other rewrites work / engine enabled. – jimg Feb 18 '10 at 02:42
0

You haven't mentioned an OS, and this isn't what you asked for (a rewriterule) -- but it does block attacks.

I use Fail2Ban to block all kinds of junk on Ubuntu; using the webserver log, the sshd log and others.

An incident = a regexp + a log file.

A rule can say when there are NN incidents in time T add a ban in the firewall for the IP for X minutes. The default is like 10 minutes... which is good if you accidentally ban yourself. If you are not worried about that, it can be set longer.

The nice thing about this approach is that you can ban all traffic from that IP and not just traffic against the web server. Also, instead of getting an indication like REFUSED or FORBIDDEN, the traffic can simply hang and never be delivered or acknowledged.

Paul
  • 1,634
  • 15
  • 19
  • OS = debian. its a vps box. Will look into Fail2ban, but was hoping for a rewrite solution - exploit attempts are coming from multiple IP's – jimg Feb 18 '10 at 14:10
  • Fail2Ban handles multiple attackers just dandy, and can even look them up for you in whois and send a nice email somewhere for tracking or safekeeping. – Paul Feb 18 '10 at 14:27