Protéger apache des accès indésirables

[irl]

Bonjour, cela fait quelques jours que mon srv apache (en dmz derrière un ipcop 1.4.2) est de plus en plus lent et parfois NOT RESPONDING.
Quand je vais voir dans les logs d'accès d'apache je vois ceci :
217.238.156.36 - - [21/Feb/2005:17:13:49 +0100] "GET http://members.bangbus.com/ HTTP/1.0" 502 482
165.76.203.148 - - [21/Feb/2005:17:13:50 +0100] "GET http://www.cashing-plaza.net/img/lnk01.gif HTTP/1.0" 304 0
165.76.203.148 - - [21/Feb/2005:17:13:50 +0100] "GET http://www.cashing-plaza.net/img/lnk02.gif HTTP/1.0" 304 0
213.156.52.103 - - [21/Feb/2005:17:13:50 +0100] "HEAD http://www.bikinivoyeur.com/umembers/ HTTP/1.0" 403 0
165.76.203.148 - - [21/Feb/2005:17:13:50 +0100] "GET http://www.cashing-plaza.net/img/lnk00.gif HTTP/1.0" 304 0
165.76.203.148 - - [21/Feb/2005:17:13:50 +0100] "GET http://www.cashing-plaza.net/img/copyright.gif HTTP/1.0" 304 0
165.76.203.148 - - [21/Feb/2005:17:13:50 +0100] "GET http://www.cashing-plaza.net/img/sn.gif HTTP/1.0" 304 0
165.76.203.148 - - [21/Feb/2005:17:13:50 +0100] "GET http://www.cashing-plaza.net/img/menu03b.gif HTTP/1.0" 304 0
220.65.127.2 - - [21/Feb/2005:17:13:50 +0100] "GET http://www.coma.ais.ne.jp:80/~allasone/ ... prxjdg.cgi HTTP/1.1" 200 2100
60.34.2.52 - - [21/Feb/2005:17:13:50 +0100] "GET http://www14.a8.net/0.gif?a8mat=TTWD6+2KA7JM+B7C+HWI5T HTTP/1.0" 200 43
165.76.203.148 - - [21/Feb/2005:17:13:50 +0100] "GET http://ad.jp.ap.valuecommerce.com/servl ... =872726834 HTTP/1.0" 302 89
165.76.203.148 - - [21/Feb/2005:17:13:51 +0100] "GET http://www.cashing-plaza.net/img/menu02b.gif HTTP/1.0" 304 0
165.76.203.148 - - [21/Feb/2005:17:13:51 +0100] "GET http://www.cashing-plaza.net/img/title.gif HTTP/1.0" 304 0
217.238.156.36 - - [21/Feb/2005:17:13:51 +0100] "GET http://members.bangbus.com/ HTTP/1.0" 401 2150
165.76.203.148 - - [21/Feb/2005:17:13:52 +0100] "GET http://www.cashing-plaza.net/img/s.gif HTTP/1.0" 304 0
165.76.203.148 - - [21/Feb/2005:17:13:52 +0100] "GET http://www.cashing-plaza.net/img/menu04b.gif HTTP/1.0" 304 0
165.76.203.148 - - [21/Feb/2005:17:13:52 +0100] "GET http://www.cashing-plaza.net/img/menu05b.gif HTTP/1.0" 304 0
165.76.203.148 - - [21/Feb/2005:17:13:52 +0100] "GET http://ad.jp.ap.valuecommerce.com/vc/images/1x1.gif HTTP/1.0" 404 1022
24.218.150.17 - - [21/Feb/2005:17:13:53 +0100] "GET http://e4.edit.cnb.yahoo.com/config/log ... swd=123456 HTTP/1.0" 999 1251
165.76.203.148 - - [21/Feb/2005:17:13:53 +0100] "GET http://www.cashing-plaza.net/img/menulogo.gif HTTP/1.0" 304 0
84.195.110.151 - - [21/Feb/2005:17:13:53 +0100] "HEAD http://www.sweetgeorgia.com/Members/index.htm HTTP/1.1" 401 0
217.85.16.19 - - [21/Feb/2005:17:13:53 +0100] "GET http://l32.login.scd.yahoo.com/config/l ... swd=happy1 HTTP/1.0" 999 1251
165.76.203.148 - - [21/Feb/2005:17:13:53 +0100] "GET http://www.cashing-plaza.net/img/menu01b.gif HTTP/1.0" 304 0
165.76.203.148 - - [21/Feb/2005:17:13:53 +0100] "GET http://www.cashing-plaza.net/list/img/tag01.gif HTTP/1.0" 304 0
84.82.219.59 - - [21/Feb/2005:17:13:54 +0100] "GET http://www.kliks.nl/stats2/statisch.php ... emo&banner HTTP/1.1" 302 0
63.135.1.45 - - [21/Feb/2005:17:13:54 +0100] "GET http://edit.member.yahoo2.akadns.net/co ... asswd=lara HTTP/1.0" 999 1251
80.141.208.140 - - [21/Feb/2005:17:13:54 +0100] "CONNECT login.icq.com:443 HTTP/1.0" 200 -
192.168.2.1 - - [21/Feb/2005:17:13:54 +0100] "GET / HTTP/1.0" 200 19181
165.76.203.148 - - [21/Feb/2005:17:13:54 +0100] "GET http://www.cashing-plaza.net/dbimg/1000005.gif HTTP/1.0" 304 0
84.82.219.59 - - [21/Feb/2005:17:13:54 +0100] "GET http://www.kliks.nl/stats2/view.php?ils ... banner.gif HTTP/1.1" 302 0
165.76.203.148 - - [21/Feb/2005:17:13:55 +0100] "GET http://www.cashing-plaza.net/list/img/tmenu06.gif HTTP/1.0" 200 1030
192.168.2.1 - - [21/Feb/2005:17:13:55 +0100] "GET / HTTP/1.0" 200 19181
69.44.153.57 - - [21/Feb/2005:17:13:56 +0100] "GET http://www.google.com/ HTTP/1.1" 302 214
83.222.4.60 - - [21/Feb/2005:17:13:57 +0100] "GET http://findme.ru:80/Counter/?id=51638&js=0 HTTP/1.1" 200 5
222.139.7.111 - - [21/Feb/2005:17:13:57 +0100] "GET http://61.121.100.107/trino/ProxyJ/prxjdg.cgi HTTP/1.0" 404 485

y a-t-il moyen de se protéger contre tout ces accès indésirables qui bloquent la connexion réseau du serveur???

Merci d'avance.

[irl]

Bon je viens de me démerder pour trouver une partie de solution afin de mieux sécuriser apache et refuser l'accès à certaines requêtes "douteuses" (selon règles snort) ou provenant d'une blacklist.
Il faut ajouter un module dans apache : MOD_SECURITY (http://www.modsecurity.org/index.php)

Pour les blacklist , il faut utiliser un programe en perl balcklist_to_modsec.pl (http://prwdot.org/docs/blacklist_to_modsec.html)

cela crée un fichier compatible avec mod_security et on doit l'inclure dans le httpd.conf.

Je l'ai testé et cela marche sous apache 1.3 et 2 sous windows. J'ai pas testé sous linux, mais y a pas de raisons que ca ne marche pas.

Merci quand même à tout ceux qui ont cherché.