Automatically block IP in apache2 - it is possible?
772
Is there are a way to automatically block IPs with apache2. For example, if we get a lot requests (100s) for non-existing pages (or known patterns, like CHANGE_LIST.txt, etc.) to block that IP and add it to deny list.
You could do this using something like fail2ban, which can be made to monitor Apache log files for requests such as you have described and then execute some action when a threshold is reached. That action may modify your local firewall configuration to block the requestor, or perform some other action to cause Apache to reject the requests.
You could do this using something like fail2ban, which can be made to monitor Apache log files for requests such as you have described and then execute some action when a threshold is reached. That action may modify your local firewall configuration to block the requestor, or perform some other action to cause Apache to reject the requests.
Have you tried mod_evasive? It may be exactly what you are looking for, depending on the block time you want.