Re: [mod-security-users] Custom directive needed

[Ivan R. <iv...@we...>]

Wally wrote:
> Hey guys, i need to know how to block this one call in mod_security.
> Here is the error_log with the errors that i want to stop happening.
> The problem is that these errors take up the bandwidth, so i need to
> know how to stop apache handling them.
 >
> 
> /usr/local/apache/logs]# tail -f access_log
> 211.229.230.115 - - [02/Aug/2005:01:21:21 -0400]
> "6bNLilgBIbuJkWI3pww0QhnhnM" 501 -

   You don't need/want mod_security for that. Tail the access log from
   a script, extract the IP addresses that are attacking you, and
   use blacklist (http://www.apachesecurity.net/tools/) to deny access
   to them on the firewall.


> 60.214.223.1 - - [02/Aug/2005:01:21:34 -0400] "-" 408 -

   BTW, these are not necessarily attacks. They could be, but only
   if they are coming in large numbers.

-- 
Ivan Ristic
Apache Security (O'Reilly) - http://www.apachesecurity.net
Open source web application firewall - http://www.modsecurity.org