Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a Linux web server running Rails and each time I check the Nginx logs I find attempts to access PHPMyAdmin, database and admin directories such as this:

190.196.161.110 - - [16/Oct/2011:23:37:31 +0100] "GET //PHPMyAdmin/ HTTP/1.1" 404 728 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"

The attacks are coming from a variety of different IP addresses and they just increment version numbers and check each directory, e.g. GET //PHPMyAdmin 1.0/, GET //PHPMyAdmin 1.1/ etc.

Will this affect the performance of my web server much? Also, is there a way to automatically ban IP addresses that do such things e.g. like fail2ban for ssh log-in attempts.?

share|improve this question

2 Answers 2

up vote 10 down vote accepted

If you're using Apache for such applications, you may want to look into ModSecurity, mod_evasive and/or mod_qos. The latter two are more geared towards brute force and DoS attacks. ModSecurity though has a ton of stuff under its banner.

share|improve this answer
    
I'll look into Apache, thanks! –  rsl Oct 17 '11 at 14:41

Fail2ban has an example script for doing this from Apache log files. Basically look for the PHPMyAdmin string in your logs with a 404.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.