{"id":19662742,"url":"https://github.com/brunexgeek/mod_bouncer","last_synced_at":"2025-04-28T21:32:08.148Z","repository":{"id":37007175,"uuid":"504077986","full_name":"brunexgeek/mod_bouncer","owner":"brunexgeek","description":"Apache2 module to block requests via pattern matching.","archived":true,"fork":false,"pushed_at":"2022-06-27T10:18:27.000Z","size":66,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-02-27T03:26:59.233Z","etag":null,"topics":["apache-module","apache2","blocklist","request-filtering","security"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/brunexgeek.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-06-16T08:41:13.000Z","updated_at":"2024-06-07T01:07:12.000Z","dependencies_parsed_at":"2022-08-27T22:03:43.806Z","dependency_job_id":null,"html_url":"https://github.com/brunexgeek/mod_bouncer","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brunexgeek%2Fmod_bouncer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brunexgeek%2Fmod_bouncer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brunexgeek%2Fmod_bouncer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brunexgeek%2Fmod_bouncer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/brunexgeek","download_url":"https://codeload.github.com/brunexgeek/mod_bouncer/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251391266,"owners_count":21582139,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apache-module","apache2","blocklist","request-filtering","security"],"created_at":"2024-11-11T16:12:13.446Z","updated_at":"2025-04-28T21:32:07.854Z","avatar_url":"https://github.com/brunexgeek.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# mod_bouncer\n\n`mod_bouncer` is a module for Apache 2.4 that blocks incoming requests containing specific patterns in their URL path. Blocked requests can be sent to a log file, enabling external tools (e.g. `fail2ban`) to set firewall rules to completely block attackers or generate alerts.\n\n## Build and install\n\nYou need the [APXS](https://httpd.apache.org/docs/2.4/programs/apxs.html) tool to build and install the module.\n\nUse the script `build.sh` to build the module and `install.sh` to install and activate the module in your Apache installation. Make sure you have the necessary privileges to use `install.sh`.\n\n```\n# ./build.sh\n# sudo ./install.sh\n```\n\nYou need to restart the Apache service after the installation.\n\n## Configuration\n\n`mod_bouncer` offers the following directives to be used in the server configuration.\n* **BouncerEngine**: Enable (`on`) or disable (`off`) the `mod_bouncer`. This directive should appear before any other. By default the `mod_bouncer` is disabled.\n* **BouncerPattern**: Add one or more patterns. Patterns are separated by spaces and must be 3 to 255 characters long. Valid characters are (see section [2. Characters](https://www.rfc-editor.org/rfc/rfc3986#section-2) of [RFC 3986](https://www.rfc-editor.org/rfc/rfc3986)): `A-Z`, `a-z`, `0-9`, `-`, `.`, `_`, `~`, `:`, `/`, `?`, `#`, `[`, `]`, `@`, `!`, `$`, `\u0026`, `'`, `(`, `)`, `*`, `+`, `,`, `;`, `%`, and `=`. You can also use `^` as the first character to indicate the pattern must appear at the beginning of the URL path. This directive can be used multiple times.\n* **BouncerPatternFile**: Add patterns via external text file. Each line of the file is equivalent to a `BouncerPattern` directive. This directive can be used multiple times.\n* **BouncerTrustedProxy**: List of trusted proxies IP addresses. This list is used to find out the internet address of the client when Apache is behind one or more internal proxies. For more accurate results, each internal proxy in the chain should appear here. This directive can be used multiple times. For more information, see [X-Forwarded-For](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For) at MDN. The address discovered is shown in the log along with the current client address (probably from an internal proxy).\n* **BouncerLog**: Path to the log file. Make sure the Apache process has the necessary privilege to write to the file. This log contains entries for every blocked request and can be monitored by tools (e.g. `fail2ban`) to change firewall rules or generate alerts.\n\n## Pattern file\nThe pattern file, used by the `BouncerPatternFile` directive, specifies a set of patterns. This file is especially useful for sharing patterns between virtual hosts. Each line in the file is equivalent to a `BouncerPattern` directive.\n\nThe first argument of each pattern is a set of HTTP methods to which the pattern will be applied. More than one method can be specified, separating them with vertical bars (|). Possible values are one or more of: `GET`, `POST`, `PUT`, `DELETE`, `CONNECT`, `OPTIONS`, `TRACE` and `PATCH`. The special value `ANY` can be used to match all HTTP methods.\n\n```\nGET|POST /xmlrpc cgi-bin\nPOST /changeUser /delete_file\nANY virus\n```\n\n## Example\n\nExample of server at `10.0.1.25` that receives requests through a proxy at `10.0.1.24`:\n\n```apache\n\u003cVirtualHost 10.0.1.25:80\u003e\n    ...\n    \u003cIfModule mod_bouncer.c\u003e\n            BouncerEngine on\n            BouncerPattern GET|POST .git ^/wp-admin\n            BouncerPattern ^/xmlrpc\n            BouncerLog /run/mod_bouncer.log\n            BouncerTrustedProxy 10.0.1.24\n            BouncerPatternFile mod_bouncer.txt\n    \u003c/IfModule\u003e\n    ...\n\u003c/VirtualHost\u003e\n```\nExample of output for blocked request in `/run/mod_bouncer.log`. The address `200.10.3.22` in the example was extracted from `X-Forwarded-For` header since `10.0.1.24` is a trusted proxy.\n\n```\n2022-05-10T09:28:40-0400 [BLOCKED] 10.0.1.24 200.10.3.22 GET \"/wp-admin/ps\" 404 \"\" \"curl/7.68.0\"\n\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbrunexgeek%2Fmod_bouncer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbrunexgeek%2Fmod_bouncer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbrunexgeek%2Fmod_bouncer/lists"}