Ask HN: How do you continuously monitor web logs for hack attempts?

Re:Ask HN: How do you continuously monitor web logs for hack... by Neil44 on Tuesday May 08, 2018 @03:03AM (#17019354)

I use some custom fail2ban rules on my web servers, for example too many hits on url X in a 10 minute window = firewalled for a day. Helps stop brute forcing on web apps e.g. Wordpress and can cut down massively on the traffic the server is having to deal with.

I Also have some mod_rewrite rules in to 403 some URL’s that bots currently hit, mostly because I don’t want to spend 200ms of PHP time for the bot to discover that it’s exploit didn’t work.

I accept that when you’re hosting websites for a load of other people you’re gonna need backups too, that’s the bottom line.

[ Parent | on HN ]

Re:Ask HN: How do you continuously monitor web logs for hack... by busterarm on Tuesday May 08, 2018 @10:14AM (#17021002)

I don't even give them the courtesy of a 403. That's more information than they deserve. HAproxy severely throttles their requests, at no cost to my web servers, and eventually stops responding entirely.

Converting our WordPress sites to static sites greatly simplified and improved our infrastructure.

[ Parent | on HN ]