Block IP after x number of failed access attempts

[eddy556]

Hi, I'm running Apache with basic Auth running on it to authenticate users.  My question is how do I block a certain IP address after an x number of failed access attempts?

 

Thanks :-)

[thedarkwinter]

Hi

 

I dont know how to do it with apache, but if you are on a linux server (which i assume??) then have a look at a package called fail2ban. I haven't used it for this purpose but i know it can be done.

http://www.fail2ban.org

 

cheers,

tdw

[steviewdr]

fail2ban is your man.

 

It will parse apache, mail, ssh, ftp, etc. log files, and when X attempts to connect fail, it will add a iptables rule for 5 minutes automatically.

 

On debian and Ubuntu:

apt-get install fail2ban

 

On Centos/Fedora:

vi /etc/yum.repos.d/dries.repo

[dries]

name=Extra Fedora rpms dries - $releasever - $basearch

baseurl=http://ftp.belnet.be/packages/dries.ulyssis.org/fedora/linux/$releasever/$basearch/dries/RPMS/

includepkgs=phpmyadmin,fail2ban

 

yum update

up2date yum

yum install fail2ban

 

-steve

 

[eddy556]

Nah sorry its running Windows Server 2003 (I tried Ubuntu but there are no drivers for my GFX card).  Any windows versions of this?

 

Thanks 

[steviewdr]

(I tried Ubuntu but there are no drivers for my GFX card) - I bet there are drivers somewhere for that, and if not, Im sure there'd be a generic driver.

 

I dont know of any similar app to fail2ban for windows

 

-steve