Re: [users@httpd] deny announce.php torrent requests

2015-03-12 Thread Yann Ylavic
On Thu, Mar 12, 2015 at 9:59 AM, Yann Ylavic ylavic@gmail.com wrote: I think you need either an action that drops the connection (deny = drop, without any response!), or a status code that implies Connection: close (deny,status=503 for example, whereas the default 403 keeps the connection

Re: [users@httpd] deny announce.php torrent requests

2015-03-12 Thread Yann Ylavic
Hi, On Thu, Mar 12, 2015 at 4:13 AM, el kalin ka...@el.net wrote: so far i have tried this: with mod_security (within modsecurity.conf): SecRule REQUEST_URI \?info_hash\= phase:2,id:'1002',t:none,rev:1,severity:2,log,deny,msg:'Torrent Announce Hit Detected' here i can see in the

Re: [users@httpd] deny announce.php torrent requests

2015-03-12 Thread Frederik Nosi
Hi, not replying to your question but probably useful, On 03/12/2015 04:13 AM, el kalin wrote: hi all… i have a bit of an issue with torrent announce.php?info_hash= requests. it sure feels like some sort of dos or ddos. i have tried different ways to configure apache to drop those request

[users@httpd] deny announce.php torrent requests

2015-03-11 Thread el kalin
hi all… i have a bit of an issue with torrent announce.php?info_hash= requests. it sure feels like some sort of dos or ddos. i have tried different ways to configure apache to drop those request using mod_security, mod_rewrite, etc but never the less i still see a lot of ESTABLISHED states that