8

I have been getting a lot of failed attacks targeting my server in the last few months. I have been using the Drupal IP block to block IPs that where sniffing for vulnerabilities. I would like to know if this is only for drupal or is it adding it to the OS as well. Also once I block an IP address what do the attackers see? Do they get a 404? Do they get a banned message? or nothing at all? If this is not also adding to the server OS IP block is there a module that will?

11

They see a blank 403 page with this message specifying that their IP address has been banned:

enter image description here

The block is done at the application level. Drupal inserts a record into the blocked_ips table which is referenced upon bootstrapping; if a match is found the above page is shown.

I've not heard a module that does this at the OS level. Considering the variety of environments it would have to accommodate, and the potential harm of giving an application OS-level blocking (e.g. Drupal blocking you could lock you out of your own server), it's likely it doesn't exist.

  • Thank you, This was very helpful. There is still a few people hitting my server at the ip level so I need to find a solution to that. but drupal has reduced a lot of the bad user hits I have got. – Patrick W. McMahon Oct 16 '15 at 18:21
  • The IP block feature works as a small scale solution to block non-sophistic malicious agents; it doesn't work well against, for example, a large scale DDoS attack. You may want to checkout ServerFault for ideas on OS-level tools or talk to your hosting provider for network-level solutions. – Shawn Conn Oct 16 '15 at 19:17
  • I'm the host provider. I own a dell blade server. Ill check out ServerFault. – Patrick W. McMahon Oct 16 '15 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.