Is it possible to use Fail2Ban to block IPs that request the same URL more
than 5 times in 10 seconds?
I'm not talking about a specific URL, but any random URL of the site that
is being requested repeatedly.
For example:
I don't want to block in a situation like this:
111.222.333.444 - - [29/Feb/2016:06:53:30] "GET /aaa.html HTTP/1.1"...
111.222.333.444 - - [29/Feb/2016:06:53:30] "GET /bbbb.html HTTP/1.1"...
111.222.333.444 - - [29/Feb/2016:06:53:30] "GET /ccccc.html HTTP/1.1"...
111.222.333.444 - - [29/Feb/2016:06:53:30] "GET /dddddd.html HTTP/1.1"...
111.222.333.444 - - [29/Feb/2016:06:53:30] "GET /eeeeeee.html HTTP/1.1"...
111.222.333.444 - - [29/Feb/2016:06:53:30] "GET /ffffffff.html HTTP/1.1"...
But I want to block in a situation like this:
111.222.333.444 - - [29/Feb/2016:06:53:30] "GET /aaa.html HTTP/1.1"...
111.222.333.444 - - [29/Feb/2016:06:53:30] "GET /aaa.html HTTP/1.1"...
111.222.333.444 - - [29/Feb/2016:06:53:30] "GET /aaa.html HTTP/1.1"...
111.222.333.444 - - [29/Feb/2016:06:53:30] "GET /aaa.html HTTP/1.1"...
111.222.333.444 - - [29/Feb/2016:06:53:30] "GET /aaa.html HTTP/1.1"...
111.222.333.444 - - [29/Feb/2016:06:53:30] "GET /aaa.html HTTP/1.1"...
Thanks!
------------------------------------------------------------------------------
Site24x7 APM Insight: Get Deep Visibility into Application Performance
APM + Mobile APM + RUM: Monitor 3 App instances at just $35/Month
Monitor end-to-end web transactions and take corrective actions now
Troubleshoot faster and improve end-user experience. Signup Now!
http://pubads.g.doubleclick.net/gampad/clk?id=272487151&iu=/4140
_______________________________________________
Fail2ban-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fail2ban-users
