Mod_qos Tailblock

If you are running Apache behind mod_qos and seeing a flood of “access denied” entries from a handful of IPs, you can turn that log data into an automatic blocklist with a short bash loop. The script below watches the error log, counts denials per IP, and rejects any address that crosses a threshold.

Continuous Monitor

This loop runs every 10 seconds, inspects the last 1,000 lines of the live error log, and blocks any IP with more than 10 denials that is not already in the bad_list file.

while true; do
  tail -1000 /usr/local/apache/logs/error_log \
    | grep "access denied" \
    | cut -d= -f4 \
    | sort \
    | uniq -c \
    | while read ct ip; do
        if [[ $ct -gt 10 ]]; then
          if [[ $(grep "$ip" bad_list | wc -l) -gt 0 ]]; then
            echo "Blocked ${ip} already"
          else
            echo "Blocking ${ip}"
            iptables -I INPUT -s "$ip" -j REJECT
            echo "$ip" >> bad_list
          fi
        fi
      done
  sleep 10
done

One-Time Check of an Archived Log

Use this variant when you want to audit a rotated log file (for example, after an incident) with a higher threshold of 20 denials.

zcat /usr/local/apache/logs/archive/error_log-11-2013.gz \
  | tail -5000 \
  | grep "access denied" \
  | cut -d= -f4 \
  | sort \
  | uniq -c \
  | while read ct ip; do
      if [[ $ct -gt 20 ]]; then
        if [[ $(grep "$ip" bad_list | wc -l) -gt 0 ]]; then
          echo "Blocked ${ip} already"
        else
          echo "Blocking ${ip}"
          iptables -I INPUT -s "$ip" -j REJECT
          echo "$ip" >> bad_list
        fi
      fi
    done

How It Works

1. tail pulls the most recent log lines.
2. grep "access denied" isolates mod_qos denial entries.
3. cut -d= -f4 extracts the client IP (the fourth =-delimited field).
4. sort | uniq -c produces a count per IP.
5. The while read loop compares the count against the threshold.
6. If the IP is new, iptables -I INPUT -s <ip> -j REJECT drops traffic and the IP is appended to bad_list so it is not re-processed.

Notes

Unblocking an IP

To remove a block, delete the matching iptables rule and remove the IP from bad_list:

iptables -D INPUT -s <ip> -j REJECT
sed -i '/<ip>/d' bad_list

Replace <ip> with the actual address.

• Security
• SysAdmin

• Bash
• SysAdmin
• Troubleshooting