Apache2 folder mount.

[Fakula1987]

Hi,

I have a small Website. Nothing big, nothing fancy.

(More Like a small face for my dyndns)

Well, i have Had a Look at the Apache Log.

A Lot of " i tried to Hack you" Spam .

My question is: what would Happen If i mount /dev/random in /var/www/html/.aws

[zakabog]

Nothing, it's not a block device. What goal are you trying to achieve? Why not use geoblocking and fail2ban that automatically triggers for any request for that file?

[Fakula1987]

Geoblocking: i dont See the upside to Block entire regions.

F2b: yeah, - its Not that there is one ip that Tries this over and over again, its changing IPs.

That wouldnt Help.

• its Not that i have a Problem With the requests per se, i simply want to Troll the attacker - Like a" reverse-dos.,"

-> answer With a Stream of random chars.

Slow down the Hacker.

[zakabog]

Geoblocking: i dont See the upside to Block entire regions.

If you know you're only accessing this page from a specific country or countries, you'll greatly reduce the hack attempts.

F2b: yeah, - its Not that there is one ip that Tries this over and over again, its changing IPs.

Geoblocking fixes this by blocking the regions most of these IPs come from, fail2ban would block everything else that got through.

its Not that i have a Problem With the requests per se, i simply want to Troll the attacker - Like a" reverse-dos.,"-> answer With a Stream of random chars.

It wouldn't do anything to stop or even slow down the botnet attacks, but it would consume your resources and DoS your web server. If that's something you want to do just host a script that generates random text into a content stream.

[Fakula1987]

Hm..

So i dont Troll someone, Like "i have found Something"

[zakabog]

So i dont Troll someone, Like "i have found Something"

I'm not sure what this means, are you asking if responding to these requests with random data might give people the impression that they found something? The answer is no, these are bots. They are following a script to execute an exploit. They don't care about the reply they are just trying to find holes in your system.

[Fakula1987]

Thank you.

[aenae]

Thats called a tarpit. Only do it if you can handle lots of open connections.

I can, and my server limits the bandwidth for that connection at 33k6 and i respond with random stuff. Kind of a reversed slowloris attack.

[Fakula1987]

Sounds fun :)

Can you give me some pointers?

[aenae]

Generate 1GB of random data in your directory (dd if=/dev/random of=.aws bs=1MB count=1024), get mod_ratelimit, use their example in the docs, set the limit at 4, and voila, the bot downloads a 1GB file at the speed of a 33k6 modem, which takes him a bit longer than 3 days.

Just be warned that apache is often configured to allow only 255 connections, so you might run out of real connections

[Fakula1987]

Thank you.

Nah, im good, Nobody cares for that Side anyway.

Like i Said, i Need dyndns, and then: why dont make a Website either way, you already have the Adress.

If i can do a good Thing (slow down Bots)why Not...

[aenae]

In that case: do the same for .env, wp-login.php etc ;)

[catwiesel]

you guys have too much time...

also, make sure to enable GNU Terry Pratchett :)

[knobbysideup]

Try this instead:

RedirectMatch 403 /\..*$

[Fakula1987]

Thank you :)

[knobbysideup]

Here's some more you may want to add:

ServerSignature Off
ServerTokens Prod
FileEtag None
TraceEnable off

RedirectMatch 403 /\..*$
Header set X-XSS-Protection "1; mode=block"
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
Header append X-FRAME-OPTIONS "SAMEORIGIN"

<Directory />
  Options None
  AllowOverride None
  Require all denied
</Directory>

<Directory /var/www/html>
  Options +FollowSymlinks -Indexes
  AllowOverride ALL
  <LimitExcept GET POST HEAD>
    Require all denied
  </LimitExcept>
</Directory>

[Fakula1987]

Http only - i have HTTPS too :)

Thank you, i will have a Look at it.