I've been noticing in my site logs that I'm getting a lot of notices of

access denied 2015-04-22 15:20 node/add Anonymous (not verified)

Most of which are coming from a set of IPs, and in quick succession (we're talking milliseconds). Clearly, these are bots that are trying to add their spam to my site.

Is there anything out there I can use to track and block users if they try to illegally add nodes? I have become familiar with D7's flood table after a series of bruit force attacks. So I feel like it should be possible to do something similar to that with access denied errors for node/add. The question is, has anyone every done that? Or is that something that would require a custom module?

The ideal functionality of this solution would to be ban (ether permanently or temporarily) an IP after x attempts resulting in access denied in x time period. Probably something like 5 access denied notices in a second or so.

  • 1
    Your Drupal already blocked attempts to add nodes, didn't it? And it seems to me that it wasn't any logged-in user, so no need or way to log out or disable particular users (in Drupal meaning of the term). What more do you want? Or what am I missing? – Mołot Apr 22 '15 at 19:46
  • It did, but the hits are obviously malicious, and I would like to limit the impact of them on my site's bandwidth/log files. – Jance Apr 22 '15 at 19:57
  • 1
    So what exactly you meant by "blocking"? Stopping them from being logged? For bandwidth, you don't want to serve heavy 403 / 404? Don't want to serve anything after X attempts by the same IP? Or what, exactly? Because we both know there is no real way to stop requests from coming on the receiving end. Well, maybe if you changed path to content/write with hook_menu_alter or something, but many things may depend on the original one. – Mołot Apr 22 '15 at 20:01
  • 1
    Ideally looking for something like the latter, not serving anything to them after x attempts within x time. – Jance Apr 22 '15 at 20:06
  • Could you maybe integrate your last comment directly into question? :) – Mołot Apr 23 '15 at 14:44

Surest way I know is to block them even before they hit your Drupal. They only work if you have cooperation of sysadmin, but they are fast and pretty reliable.

mod_qos - not a protection per se, but may be used to ensure that requests to node/add will not slow down other parts of your site. That's the way I would go in your situation, probably.

ModSecurity - catch-all security module with thousands of rules available on the Internet. One of them here; sadly it's copyrighted, but you can find examples with Google or implement the same logic using Mod's own documentation, if needed.

Directly in Drupal - I wouldn't even try. CPU and database usage to store IP addresses and connection count, compare them at each request etc is not worth what you can save in bandwidth. Just make 403 page a lightweight one.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.