On 8/31/2011 11:22 AM, Always Learning wrote: > On Wed, 2011-08-31 at 11:16 -0400, m.roth at 5-cent.us wrote: > >> Maybe not, for a small website. However, let me re-suggest fail2ban, with >> three lines from one of our config files: >> failregex = <HOST> -.*"GET .*(php|pma|PMA|p/m/a|db|sql|admin).*/(config/c >> onfig\.inc|main)\.php.*".*404.* >> ^<HOST> -.*"GET .*(phpmyadmin).*\.php.*".*404.* >> ^<HOST> -.*"GET /w00tw00t\.at > Mark, > > Looking at your example seems to suggest Fail2Ban is an 'after the > event' response. I would like to implement 'before the event' filtering > which prevents, even on the first detected hacking attempt, anything > reaching HTTPD. I assume this is an Apache server. Have you looked at mod_security (http://www.modsecurity.org/)? It is available from the epel repository. There is a bit of a learning curve to get it running, but it protects against a ton of hacking attempts. -- Bowie