Hi,

I'm coding a module to somehow replace/complement mod_security (it's more a proof of concept than a real project for now). The first thing that I'd like to have is a DNSBL, so that detected intruders are instantly banned when added to the blacklist. Because doing a DNS query for each HTTP request might be a bit heavy, I'd like to keep the results in cache.

I guess that if I create something from the config pool, it will be duplicated between processes. But another security I want is to check URL against regexps commonly used by botnets/script kiddies. Then, if an IP is blacklisted, I want its state to be changed instantly in all caches. Which, if data is duplicated, is not possible. Would there be a simple way to achieve this ? Or would it be more clever to move to another solution, like using a common redis datastore for blacklist/whitelist/rules lookup ?

Thanks,
Rémy

Reply via email to