Search code examples
mod-security2

how to block specific IP addreess with mod_security after specific times in one minute

Well, normally I'm not the person intended to do that, I'm a PHP developer and have general knowledge about Apache and security administration, but for emergency only I have to do this now.

I'm in a situation where I need to write Mod_Security rule that:

 - blocks specific IP address from access our website,
 - for 5 minutes
 - if it try to call more than 10 links in less than 10 seconds

Can I achieve that writing a mod_security rule?

Solution

  • ModSecurity can do this, but wouldn't suggest it.

    Have a look at the DOS rules in the OWASP CRS: https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/master/experimental_rules/modsecurity_crs_11_dos_protection.conf. Note these do depend on set up in the main CRS setup file: https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/master/modsecurity_crs_10_setup.conf.example

    However ModSecurity collections are not the most stable especially for high volume. You run into problems with multiple threads accessing the collection file. Also might find you have to delete the collection file regularly (e.g. every 24 hours) to prevent it continually growing.