Re: [cobalt-users] Deny IP

["Steven Werby" <steven-lists@xxxxxxxxxxxx>]

Frank Cubillos <cubillos@xxxxxxxxxxxxxxxxxx> wrote:
> Searched through the Cobalt resources no avail. Seeing these kiddie
> scripters trying to hack a protected directory really Pi***d me off. How can
> I add their IP to block them access, or is that possible. I know we can do
> that on the smtp on the raq3.

Take a look at the docs at http://www.apache.org/.  You can block an IP or subnet,
redirect it to a different page or do a number of other interesting things.  You can
even implement thes solutions on a site by site basis (or directory by directory) by
using in .htaccess instead of in the global apache config file.

> Any help or suggestions will be greatly appreciated!

FYI, it's not uncommon to see these kind of exploits in your logs.  The best thing
you can do is make your server as secure as possible and have a system in place for
monitoring unusual activity (see previous threads on tripwire and other products).
Today's script kiddie is sophisticated enough to have a number of IP addresses at
his/her disposal so blocking the IP is probably going to do little more than make
her/him more interested in the challenge of penetrating your system.  I'm not saying
it's a bad idea, but it's not the cure for the problem.

Just my 2 cents.

Steven Werby {steven-lists@xxxxxxxxxxxx}