Topic: Bruteforce protection for authentication in apache?

[dke]

Hi!

I was wondering if there's a simple way to implement some kind of authencation bruteforce protection in apache for windows? Right now my authentication never stops asking if user inputs the wrong credentials, this makes me think i'm vounrable for bruteforce attacks which could eventually get through if given the time.

Any ideas what could be done?

[James Blond]

Can you plese post your auth config?

[dke]

i have a very old and basic setup, i used the htpasswd file to create the authentication details and in httpd config it looks like this:

[James Blond]

mod security can do blocking those requests.

See http://snippets.aktagon.com/snippets/563-brute-force-authentication-protection-with-modsecurity

[dke]

Thank you!