Question

I’m receiving many failed login requests from spammers/bots that are trying to brute-force the credentials, also I’m receiving many requests to pages like /forum/index.php.

I wrote a script to parse the IP’s of those attackers from production.log:

#!/bin/bash

# Failed Logins
grep "Failed " ~/app/log/production.log | egrep -o -e "[0-9]{2,3}\.[0-9]{2,3}\.[0-9]{2,3}\.[0-9]{2,3}" | sort | uniq > ~/spammers.txt

# Try to GET .php Files
cat ~/app/log/production.log | awk '$0!~/^$/ {print $0}' | sed -n -e "N; /\.php/p" | grep "ApplicationController#index" | egrep -o -e "[0-9]{2,3}\.[0-9]{2,3}\.[0-9]{2,3}\.[0-9]{2,3}" | sort | uniq >> ~/spammers.txt

But I can’t block (.httaccess) those IP’s until I manually check their origin by Geolocation.

Is out there a Rail-ish solution for this problem?

Answer 1

I don’t think there is a Rails answer to this.

If you’re running on a linux server, you can look into using LFD (Login Failure Daemon). http://www.configserver.com/cp/csf.html

Once you set it up to watch your rails app, it would block them at the firewall level after enough failed logins, intrusion attempts, etc.