4

I experience some difficulties with formalizing a question for Google, so I'm going to post it here and request real human help=)

Are there any systems (modules or smth similar) in Drupal that monitor user activity and detect possible malicious actions? And react automatically?

For example, in some form, a dummy user tries a certain kind of SQL injection. Typing something like " or 1=1 -- or similar. This is obvious that this sort of data cannot be entered be accident. Drupal then detects this:"Ahah, this is going to be something like an SQL injection", then blocks the user IP for a month, for example, and logs all information about this event. Or sends an email to admin: "User @@ possibly tried to carry SQL injection while entering @@ form while doing @@ (situation description goes there) and was blocked for a month. See log at @@"

As I understand Drupal is pretty secure but it's secure in a passive way. I want to get it not only waiting for an attack and process it but also response to this attack. Or at least notify administrator of something anusual and therefore dangerous.

I hope you will understand what I want to get (not necessarily exactly what I mentioned) and extend the scope from my possibly idiotic imaginations to what is really used today.

7

I believe you're looking for the Drupal Tiny-IDS module:

Minimalist, but performant intrusion detection system that monitors Drupal for malicious activities and targets to be simple to understand and easy to use.

It attempts to detect:

  • XSS (Cross Site Scripting)
  • SQLi (SQL Injection)
  • Code execution (Local/Remote file inclusion, etc.)

And can 'react' in a bunch of different ways:

  • Log entry
  • Warning message (to the malicious user)
  • Mail alert
  • Rules integration (which you could use to disable the user account)

I think that ticks all the boxes :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.