mod_security sorusu

Mod security ile asagidakileri nasil filtreleyebilirim?

85.99.42.13 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
67.140.75.95 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
67.140.75.95 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
200.118.48.103 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.102.168.139 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.102.168.139 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.102.168.139 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.102.168.139 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
200.118.48.103 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.102.168.139 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.102.168.139 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
200.118.48.103 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.102.168.139 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.102.168.139 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
67.140.75.95 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.102.168.139 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
201.251.9.20 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
201.251.9.20 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
200.118.48.103 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
201.251.9.20 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.99.42.13 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
201.251.9.20 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.99.42.13 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
200.118.48.103 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
201.251.9.20 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.99.42.13 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
201.251.9.20 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
67.140.75.95 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.99.42.13 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
67.140.75.95 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.99.42.13 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
67.140.75.95 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.99.42.13 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
200.118.48.103 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
67.140.75.95 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"
85.99.42.13 - - [15/Feb/2006:17:41:37 -0600] "Ticken <%/%>%:|||:<&%%><<><?>" 400 309 "-" "-"

bunları mod security ile filtrelemen sana hiç bir yarar getirmez çünkü mod security nin yaptığı şey istekler gene sitene ulaşmasına rağmen icra edilmesini engeller
SecFilterSelective THE_REQUEST "Ticken <%/%>%:|||:<&%%><<><?>"
yada başına Ticken koyarsan Ticken geçenlerin hepsini engelelr
SecFilterSelective THE_REQUEST "Ticken"

bunu yaparak sunucunu daha çok yorucaksın devamlı u tarz istekelr geliyorsa her istek için devamlı httpd.conf a bakıcak sonra audit.log dosyasına yazıcak

şöyle bir şey yapabilirsin

bu scripti çalıştır

HOSTS=`grep "^Request:" /var/log/httpd/audit_log | awk {'print $2'} | sort | uniq`
for i in $HOSTS ; do
iptables -A INPUT -s $i mod_security -j DROP
done

apf için

HOSTS=`grep "^Request:" /var/log/httpd/audit_log | awk {'print $2'} | sort | uniq`
for i in $HOSTS ; do
/usr/local/sbin/apf -d $i mod_security
done


tabi garanti kurallar koy yoksa diğer kullanıcılarıda iptables ile banlarsın