4 ms·
Interesting idea. I can't quite see how it would work, though -- if I understand them correctly, fail2ban and mod_security rely on knowing what a suspicious UR
by gpjt 14y ago
Interesting idea. I can't quite see how it would work, though -- if I understand them correctly, fail2ban and mod_security rely on knowing what a suspicious URL looks like. We could obviously keep an eye on someone hammering, say "/login" on an external site -- but across the broader internet, there could be any number of URLs hammering which would be a Bad Thing.
Am I missing something?
- dbarlett 14y agoNormally, mod_security parses incoming traffic and blocks suspicious activity based on third-party rules [1]. Since you're using Squid, you can monitor outgoing traffic instead. Malicious traffic would get dropped instead of being proxied. Since you control the source servers, you could tarpit and/or ban the user. Snort + Snortsam [2] or fwsnort [3] would do the same thing for non-HTTP traffic. [1] https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project https://www.owasp.org/index.php/Category:OWASP_ModSecurity_C... [2] http://www.snortsam.net http://www.snortsam.net [3] http://cipherdyne.org/fwsnort/ http://cipherdyne.org/fwsnort/