Apache有個非常好用的插件叫Fail2Ban,目的是阻擋一些攻擊性或者掃描性的請求,把符合條件的請求從Apache日志里找出來并且禁止該IP的訪問一段時間.
安裝:
sudo yum install fail2ban
安裝完成后,在/etc 目錄下會多了fail2ban的目錄,此時創(chuàng)建一個jail.local 文件去配置fail2ban (sudo vi /etc/fail2ban/jail.local)
以下是在網(wǎng)上找到的配置 (可以修改bantime,并且要修改logpath指向apache的error_log才行. 調(diào)節(jié)maxretry去設(shè)定多少失敗次數(shù)后才被禁止訪問; ignoreip去除外某些IP地址):
jail.local
# detect password authentication failures
[apache]
enabled = true
filter = apache-auth
action = iptables-multiport[name=auth, port="http,https"]
logpath = /var/log/httpd/error_log
bantime = 3600
maxretry = 10
ignoreip = 10.*.*.*
# detect spammer robots crawling email addresses
[apache-badbots]
enabled = true
filter = apache-badbots
action = iptables-multiport[name=badbots, port="http,https"]
logpath = /var/log/httpd/error_log
bantime = 3600
maxretry = 1
ignoreip = 10.*.*.*
# detect potential search for exploits
[apache-noscript]
enabled = true
filter = apache-noscript
action = iptables-multiport[name=noscript, port="http,https"]
logpath = /var/log/httpd/error_log
bantime = 3600
maxretry = 5
ignoreip = 10.*.*.*
# detect Apache overflow attempts
[apache-overflows]
enabled = true
filter = apache-overflows
action = iptables-multiport[name=overflows, port="http,https"]
logpath = /var/log/httpd/error_log
bantime = 3600
maxretry = 2
ignoreip = 10.*.*.*
假如需要查看某一個Fail2Ban Filter阻止了哪些IP, 可以通過Fail2Ban-client 命令去查看:
terminal
sudo fail2ban-client status apache-noscript
以上命令就是查看apache-noscript的具體狀態(tài)和阻擋了什么IP
以下是從Google找到的一個防止URL掃描配置:
urlscanning過濾:https://unix.stackexchange.com/questions/119508/how-to-use-fail2ban-to-ban-all-php-and-cgi-bin-requests
