# Do i need mod\_security for nginx?

**URL:** <https://www.ruby-forum.com/t/do-i-need-mod-security-for-nginx/237051>\
**Category:** NGINX\
**Created:** [October 21, 2013, 10:13pm UTC](https://www.ruby-forum.com/t/do-i-need-mod-security-for-nginx/237051 "2013-10-21T22:13:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![addis\_a](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/c4cdca/32.png) [@addis\_a](https://www.ruby-forum.com/u/addis_a)\
**Post date:** [October 21, 2013, 10:13pm UTC](https://www.ruby-forum.com/t/do-i-need-mod-security-for-nginx/237051/1 "2013-10-21T22:13:38Z")

</div>

Today i found one particular IP address which was trying a lot of things  
in  
my server.

For a second, it was sending atleast 50 requests.  
It was keep on accessing my admin login page with post and get request  
That IP tried proxy GET http://…  
It tried to inject something in the script with -d parameter.

i added "limit\_req\_zone $binary\_remote\_addr zone=app:10m rate=2r/s;  
" in  
http block and  
location / {  
limit\_req zone=app burst=50;  
}

I believe it will block too many connections per second from a ip.  
How do i secure the server from other attacks?

Thanks

Posted at Nginx Forum:

> **[Do i need mod\_security for nginx?](https://forum.nginx.org/read.php?2,243933,243933#msg-243933)**
>
> Today i found one particular IP address which was trying a lot of things in my server. For a second, it was sending atleast 50 requests. It was keep on accessing my admin login page with post and get request That IP tried proxy GET http://... It...

---

<div class="post-metadata">

**Author:** ![agriz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8edcca/32.png) [@agriz](https://www.ruby-forum.com/u/agriz)\
**Post date:** [October 21, 2013, 11:17pm UTC](https://www.ruby-forum.com/t/do-i-need-mod-security-for-nginx/237051/2 "2013-10-21T23:17:55Z")

</div>

On 10/21/2013 10:12 PM, agriz wrote:

> location / {  
> limit\_req zone=app burst=50;  
> }
> 
> I believe it will block too many connections per second from a ip.  
> How do i secure the server from other attacks?

Have a look at fail2ban.

Regards,  
Patrick

---

<div class="post-metadata">

**Author:** ![agriz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8edcca/32.png) [@agriz](https://www.ruby-forum.com/u/agriz)\
**Post date:** [October 21, 2013, 11:41pm UTC](https://www.ruby-forum.com/t/do-i-need-mod-security-for-nginx/237051/3 "2013-10-21T23:41:52Z")

</div>

[nginx-auth]  
enabled = true  
filter = nginx-auth  
action = iptables-multiport[name=NoAuthFailures, port=“http,https”]  
logpath = /var/log/nginx\*/_error_.log  
bantime = 600 # 10 minutes  
maxretry = 6

[nginx-login]  
enabled = true  
filter = nginx-login  
action = iptables-multiport[name=NoLoginFailures, port=“http,https”]  
logpath = /var/log/nginx\*/_access_.log  
bantime = 600 # 10 minutes  
maxretry = 6

[nginx-badbots]  
enabled = true  
filter = apache-badbots  
action = iptables-multiport[name=BadBots, port=“http,https”]  
logpath = /var/log/nginx\*/_access_.log  
bantime = 86400 # 1 day  
maxretry = 1

[nginx-noscript]  
enabled = true  
action = iptables-multiport[name=NoScript, port=“http,https”]  
filter = nginx-noscript  
logpath = /var/log/nginx\*/_access_.log  
maxretry = 6  
bantime = 86400 # 1 day

[nginx-proxy]  
enabled = true  
action = iptables-multiport[name=NoProxy, port=“http,https”]  
filter = nginx-proxy  
logpath = /var/log/nginx\*/_access_.log  
maxretry = 0  
bantime = 86400 # 1 day

filters.d/nginx-proxy.conf  
[Definition]  
failregex = ^ -._GET http._  
ignoreregex =

nginx-noscript.conf

[Definition]  
failregex = ^ -._GET._(.php|.asp|.exe|.pl|.cgi|\scgi)  
ignoreregex =

nginx-auth.conf

[Definition]

failregex = no user/password was provided for basic  
authentication._client:_  
   
_user ._ was not found in._client:   
user ._ password mismatch.\*client:

ignoreregex =

nginx-login.conf

[Definition]  
failregex = ^ -.\*POST /sessions HTTP/1.." 200  
ignoreregex =

I m using nginx with php fpm.  
I tried to look at the fail2ban apache config files and created them  
with  
the help of internet search.

I still am having a dount on

failregex = ^ -._GET._(.php|.asp|.exe|.pl|.cgi|\scgi)

Do i really need to have .php in this regex?  
I havent restart the fail2ban service.

Or am i good to restart the fail2ban service?

Posted at Nginx Forum:

> **[Re: Do i need mod\_security for nginx?](https://forum.nginx.org/read.php?2,243933,243936#msg-243936)**
>
> Today i found one particular IP address which was trying a lot of things in my server. For a second, it was sending atleast 50 requests. It was keep on accessing my admin login page with post and get request That IP tried proxy GET http://... It...