Ever looked at your log watch and seen messages that there were X number of probes on your webserver? I'm assuming the vast majority of these "probes" come from script kiddies running things like nikto. Are there any tools out there like denyhosts but for httpd's logs... to block IPs that appear to be probing the webserver? If so, I'd really like to get that deployed. I've heard that fail2ban can be used with httpd but I believe it is only for finding failed .htaccess login attempts and I'd rather detect nikto scans and block those. Anyone?
Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds