Take the 2-minute tour ×

In one of the vhosts' error_log I found thousands of lines like these, all from the same IP:

[Mon Apr 19 08:15:59 2010] [error] [client] mod_security: Access denied with code 403. Pattern match "(chr|fwrite|fopen|system|e?chr|passthru|popen|proc_open|shell_exec|exec|proc_nice|proc_terminate|proc_get_status|proc_close|pfsockopen|leak|apache_child_terminate|posix_kill|posix_mkfifo|posix_setpgid|posix_setsid|posix_setuid|phpinfo)\\\\(.*\\\\)\\\\;" at THE_REQUEST [id "330001"] [rev "1"] [msg "Generic PHP exploit pattern denied"] [severity "CRITICAL"] [hostname "x.x.x.x"] [uri "//webmail/config.inc.php?p=phpinfo();"]

Given how obvious the situation is, how come mod_security isnt automatically adding at least that IP to deny rules? There is no way someone hasnt thought of this before...

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

If it's from the same IP, perhaps you should just block it on the firewall level?

But for APF this post should help.

share|improve this answer
I already blocked the entire class C via APF (it's in china. we have absolutely no interest in chinese visitors.), but my question is exactly how do I make this happen automatically? –  Gaia Apr 22 '10 at 16:29
You can write a script analyze our log file for mod_security: Access denied with code 403, extract the IP address, count a number of times it appears in the log, and if exceeds some kind of threshold, run a command to block that IP. –  solefald Apr 22 '10 at 16:57
that would be beyond my skill level... unless you want to assist with such script. what do you recommend? a perl script, cron'ed to run every 5 minutes, that reads the log file and adds to deny.rules when condition X is true? off topic: i've been a windows admin for a over a decade. i'm using LAMP because the best web applications (such as wordpress) run better on it, but damn so many simple basic things become so complicated in linux... –  Gaia Apr 22 '10 at 23:45
Here is a quick and dirty shell one-liner that can extract the IP addresses, and count them. grep "mod_security: Access denied with code 403" access.log | awk -F\ '{print $8}' | sed -e s/\]// | uniq -c | sort. Run this command but replace access.log with the pass to your log file. See if it works for you. You can have a shell script run every time apache log rotates. No need to run it from cron, really. –  solefald Apr 23 '10 at 0:28
thanks, i will give it a try. how do i set the script to run when the log rotates? –  Gaia Apr 23 '10 at 22:35
add comment

Your Answer


