[Dshield] A Couple of New Apache Hack Patterns
David Cary Hart
DShield at TQMcube.com
Fri Dec 16 15:39:39 GMT 2005
On Thu, 15 Dec 2005 20:47:39 -0500
jayjwa <jayjwa at atr2.ath.cx> opined:
> On Wed, 14 Dec 2005, David Cary Hart wrote:
> -> The strategy I am using these days is to SWATCH the patterns -> rewrite
> -> rule to hacker.php -> firewall rule. The purpose of the interim
> -> hacker.php is to provide information just in case of a false positive.
> -> Hacker.php then writes a unique line to access_log which swatch
> -> recognizes to trigger the firewall rule.
> You didn't try the mod_security? http://www.modsecurity.org/
I have and it is expensive. The swatch deamons consume no bandwidth and do not interfere with the responsiveness of Apache. I have since modified this to remove the rewrite and go directly to the firewall rule with an email advisory.
Our DNSRBL -
Eliminate Spam: http://www.TQMcube.com/spam_trap.php
Multi-RBL Check: http://www.TQMcube.com/rblcheck.php
Zombie Graphs: http://www.TQMcube.com/zombies.php
More information about the list