Automatically ban IP address if it accesses a certain URL

Question

I'm getting bored by all those muieblackcat's and similar scripts ran on web sites. Can I block an IP address (for example with iptables) automatically, like for a hour or so, as soon as it accesses example.com/muieblackcat?

This is on Linux, with Apache.

score 22 · Answer 1 · answered Dec 19 '11 at 15:21

22

You could, but that would make denial-of-service attacks trivial. All an attacker needs to do is access your site through the same proxy I'm using and hit one of those URLs and then I can't access your site. There are still entire cities that use a web proxy.

answered Dec 19 '11 at 15:21

David Schwartz

31,449
2
55
84

1

And then there are the users whose PCs are infected with vulnerability scanning malware. One infected PC on, say, a University intranet could cause a denial of service for the whole campus. – Phil Dec 19 '11 at 19:34
Thanks for the hint – this is a good point. Especially for well-known web sites. – Simon A. Eugster Dec 21 '11 at 07:47
Countries too, c.f. China – Tom O'Connor Dec 29 '11 at 09:38

score 15 · Answer 2 · answered Dec 19 '11 at 15:18

15

See Fail2Ban, it can parse Apache log files too.

answered Dec 19 '11 at 15:18

Stone

7,011
1
21
33

score 6 · Accepted Answer · edited Dec 29 '11 at 09:11

6

Consider tarpitting these requests instead.

HAProxy (and I assume other HTTP proxies) has the ability to identify 'malicious' scan hits and delay the response (thus temporarily slowing the attack script).

Blocking the response entirely will just have the attack script move along to its next target immediately.

edited Dec 29 '11 at 09:11

Peter Mortensen

2,318
5
23
24

answered Dec 19 '11 at 17:48

Joel K

5,853
2
30
34

That's a nice idea. HAProxy seems documented well too. I think I will use it! – Simon A. Eugster Dec 21 '11 at 07:55

score 2 · Answer 4 · edited Dec 29 '11 at 10:54

2

I would start by using a program to watch the log files; if a particular URL is accessed, it should show up in the Apache logs. You can use SEC to watch for this URL access.

When the URL access happens, then SEC can run an iptables command to block the IP address.

edited Dec 29 '11 at 10:54

Peter Mortensen

2,318
5
23
24

answered Dec 19 '11 at 15:21

Mei

4,590
8
45
53

Automatically ban IP address if it accesses a certain URL

4 Answers4