I have been getting a lot of failed attacks targeting my server in the last few months. I have been using the Drupal IP block to block IPs that where sniffing for vulnerabilities. I would like to know if this is only for drupal or is it adding it to the OS as well. Also once I block an IP address what do the attackers see? Do they get a 404? Do they get a banned message? or nothing at all? If this is not also adding to the server OS IP block is there a module that will?
Add a comment
|
1 Answer
They see a blank 403 page with this message specifying that their IP address has been banned:
The block is done at the application level. Drupal inserts a record into the blocked_ips table which is referenced upon bootstrapping; if a match is found the above page is shown.
I've not heard a module that does this at the OS level. Considering the variety of environments it would have to accommodate, and the potential harm of giving an application OS-level blocking (e.g. Drupal blocking you could lock you out of your own server), it's likely it doesn't exist.
answered Oct 16, 2015 at 16:49
-
Thank you, This was very helpful. There is still a few people hitting my server at the ip level so I need to find a solution to that. but drupal has reduced a lot of the bad user hits I have got. Commented Oct 16, 2015 at 18:21
-
The IP block feature works as a small scale solution to block non-sophistic malicious agents; it doesn't work well against, for example, a large scale DDoS attack. You may want to checkout ServerFault for ideas on OS-level tools or talk to your hosting provider for network-level solutions. Commented Oct 16, 2015 at 19:17
-
I'm the host provider. I own a dell blade server. Ill check out ServerFault. Commented Oct 16, 2015 at 19:25