SecAction phase:1,nolog,pass,setvar:IP.counter=+1

SecRule IP:UPDATE_RATE "@gt 10" \

"phase:1,block,msg:'Request rate too high for IP address: %{IP.UPDATE_RATE}'"

# Only increment the counter if the

# request is for a non-static resource

SecRule REQUEST_FILENAME "!\.(jpg|png|gif|js|css|ico)$" \

phase:,nolog,pass,setvar:IP.counter=+

# Block the IP addresses that use too

# much of the web server's time

SecRule IP.load "@gt 10000" \

"phase:1,t:none,block,\

msg:'IP address load too high: %{IP.load}'"

# Keep track of how much web server

# time is consumed by each IP address

SecAction "phase:5,nolog,pass,\

setvar:IP.load=+%{DURATION},\

deprecatevar:IP.load=/"

<Location /login.php>

# Enforce an existing IP address block

SecRule IP:bf_block "@eq 1" "phase:2,block,\

msg:'IP address blocked because of suspected brute-force attack'"

# Check for authentication failure

SecRule RESPONSE_HEADERS:Location ^/login.php \

"phase:5,chain,t:none,nolog,pass, \

msg:'Multiple authentication failures from IP address',\

setvar:IP.bf_counter=+"

SecRule IP:bf_counter "@gt 25" t:none,\

setvar:IP.bf_block,\

setvar:!IP.bf_counter,\

expirevar:IP.block=

</Location>

<Location /login.php>

# Enforce an existing IP address block

SecRule IP:bf_block "@eq 1" \

"phase:2,deny,\

msg:'IP address blocked because of suspected brute-force attack'"

# Retrieve the per-username record

SecAction phase:,nolog,pass,initcol:USER=%{ARGS.username}

# Enforce an existing username block

SecRule USER:bf_block "@eq 1" \

"phase:2,deny,\

msg:'Username blocked because of suspected brute-force attack'"

# Check for authentication failure and increment counters

SecRule RESPONSE_HEADERS:Location ^/login.php \

"phase:5,t:none,nolog,pass,\

setvar:IP.bf_counter=+,\

setvar:USER.bf_counter=+"

# Check for too many failures from a single IP address

SecRule IP:bf_counter "@gt 25" \

"phase:5,pass,t:none,\

setvar:IP.bf_block,\

setvar:!IP.bf_counter,\

expirevar:IP.block="

# Check for too many failures for a single username

SecRule USER:bf_counter "@gt 25" \

"phase:5,t:none,pass,\

setvar:USER.bf_block,\

setvar:!USER.bf_counter,\

expirevar:USER.block="

</Location>