Criar regra ModSecurity para bloquear IPs em rotas específicas

jose1310 · 29/08/2016

hola foreros

actualmente uso cpanel y comodo modsecurity

veo esta actividad en apache :

162.243.12.29 - - [29/Aug/2016:20:58:30 -0500] "POST /file-raw/access.php HTTP/1.0" 404 608 "-" "Mozilla/4.0"
123.30.245.174 - - [29/Aug/2016:20:58:30 -0500] "POST /mysql-conf/module.php HTTP/1.0" 404 608 "-" "Mozilla/4.0"
109.235.63.27 - - [29/Aug/2016:20:58:31 -0500] "POST /mysql-conf/module.php HTTP/1.0" 404 608 "-" "Mozilla/4.0"
162.243.4.15 - - [29/Aug/2016:20:58:32 -0500] "POST /file-raw/access.php HTTP/1.0" 404 608 "-" "Mozilla/4.0"
123.255.16.67 - - [29/Aug/2016:20:58:34 -0500] "POST /mysql-conf/module.php HTTP/1.0" 404 608 "-" "Mozilla/4.0"
123.255.16.67 - - [29/Aug/2016:20:58:46 -0500] "POST /file-raw/access.php HTTP/1.0" 404 608 "-" "Mozilla/4.0"
123.255.16.67 - - [29/Aug/2016:20:58:50 -0500] "POST /file-raw/access.php HTTP/1.0" 404 608 "-" "Mozilla/4.0"
123.255.16.67 - - [29/Aug/2016:20:58:56 -0500] "POST /file-raw/access.php HTTP/1.0" 404 608 "-" "Mozilla/4.0"
37.187.135.114 - - [29/Aug/2016:20:59:00 -0500] "POST /file-raw/access.php HTTP/1.0" 404 608 "-" "Mozilla/4.0

Desearia crear una regla modsecurity, para bloquear los IP que accedan a esas rutas :

/file-raw/access.php
/mysql-conf/module.php

Cual seria la regla exacta para bloquear esos IP que accedan a esas rutas??

SnAFKe · 29/08/2016

Prueba con esto

Inserir CODE, HTML ou PHP:

SecRule REQUEST_URI "/file-raw/access.php" "phase:4,log,deny,msg:'Access Denied',id:1000"
SecRule REQUEST_URI "/mysql-conf/module.php" "phase:4,log,deny,msg:'Access Denied',id:1001"

Criar regra ModSecurity para bloquear IPs em rotas específicas

jose1310

SnAFKe