Re: [mod-security-users] Blocking open proxies and TOR exit nodes using thirdparty services

[Josh Amishav-Z. <ja...@gm...>]

On Wed, Sep 14, 2011 at 4:23 PM, Come Again <com...@ho...> wrote:
> What I've understand from former postings is that ModSec Lua API support
> must be compiled within modsecurity.

Hi Come,

That is correct.

>
> Can you please give an example of how to use it?

My comment about using the Lua API was in regards to how you could
specifically use the www.shroomery.org web service to lookup IPs and
integrate the results back into ModSecurity. If you can use a
different service that supports RBL lookups that would definitely be
less work.

--
 - Josh

>
> Regards
>
> -----Original Message----- From: Josh Amishav-Zlatin
> Sent: Wednesday, September 14, 2011 2:30 PM
> To: Come Again
> Cc: mod...@li...
> Subject: Re: [mod-security-users] Blocking open proxies and TOR exit nodes
> using thirdparty services
>
> On Wed, Sep 14, 2011 at 3:18 PM, Come Again <com...@ho...> wrote:
>>
>> Hi All,
>>
>> I've read threads like:
>>
>> 'Geo Proxy Blocking - I WANT THIS!' and 'Blocking Open Proxies using GEO'
>>
>> And according to all the replies I've seen it's very hard to get i right.
>>
>> Isn't there a way to use modsecurity with services like this are similair
>> like this:
>>
>> Black Box Proxy Block: http://www.shroomery.org/ythan/proxyblock.php
>
> Hi,
>
> If the added latency of looking up the IP via a remote service is not
> a concern, you could use the ModSec Lua API to send the appropriate
> HTTP query and then act on the result.
>
> --
> - Josh
>