modsec_audit.log growing OUT of control? 550megs in just a few minutes?

[pucky]

I caught some idiot trying to brute force a wordpress installation and he sat there trying to guess passwords and usernames.

I only just enabled modsec_audit.log logging but had to turn it off because this idiot was hitting my site and the log file grew to 550megs in only minutes.

Had I not turned it off he could have bought down the box once that file reached a huge #.

So what have you guys done to prevent out of control logging like this.

Im surprised GSA didn't ban his ass but the GSA file is looking at /var/log/httpd/error_log not modsec_audit.log where the actual logging is taking place.

And what about brute force monitor? Doesn't catch this?

And nothing logged to error_log? Strange.

And I even had Login_limits plugin active on that wp site and he was banned after 4 attempts yet it kept logging to modsec_audit.log even after he was banned?

 

[pucky]

Nobody knows? Interesting!

 

[zEitEr]

Hello,


There is no (at least known to me) working out of a box solution on directadmin powered server to detect and stop brute force attacks on WP, Joomla, Drupal, and other applications. None of them: CSF/LDS, directadmin watches web-server logs for such attacks. We use a simple script to grep web-server logs and block IPs from which they do attacks.


We search and count lines with the following strings:


"POST /administrator/index.php HTTP/1"
"POST /wp-login.php HTTP/1"


for every IP. And if a number exceeds a stated limit then the IP gets blocked with CSF/LFD.