Home / server / Questions / 256245
Accepted
Joril
Asked: 2011-04-07 00:12:34 +0800 CST

How to block malformed requests to Apache

  • 772

I'd like to block malformed requests like these:

79.26.188.208 - - [05/Apr/2011:13:47:38 +0200] "\xae\xe1\x0fi\xca\xeba\xdfm\x9d\xb5\xc0yr-n\x05Z\x9f\xa7\x05\xa1g" 200 4855 "-" "-"
82.51.130.83 - - [05/Apr/2011:18:25:38 +0200] "T\xd0\xc55\xc3A\xcd\xd0" 200 4855 "-" "-"

What is the preferred method?

apache-2.2 block

2 Answers

  1. mod_security is useful for blocking many of these requests.

    It detects known exploit patterns and blocks them.

    • 1
  2. Best Answer

    Following Mikel's lead I added this mod_security rule

    SecRule REQUEST_METHOD "!^(?:GET|HEAD|OPTIONS|POST|CONNECT)$"

    and now only legitimate requests pass through.

    • 1