I had a personal wiki set up with mediawiki on my server with nginx. Recently I noticed that all my sites that used php (Mediawiki and all Wordpress sites) were not responding or timing out.

Then I found a lot of requests in my /var/log/nginx/error.log like this :

request: "GET /index.php?title=Benutzer:MikeHofmann54 HTTP/1.1"

and posts :

 "POST /index.php?title=Special%3ARunJobs&tasks=jobs&maxjobs=1&sigexpiry=1484304501&signature=a39943b5794bdc95b3d874bad2273afadb6bbd01 HTTP/1.1", upstream: "fastcgi://unix:/var/run/php5-fpm.sock:"

I (re)moved the mediawiki but the requests keep trying to reach the domain. The other sites started working and behaving normally again, but I am worried that the ongoing POST and GET requests could do something harmful to my server. Or are those 'normal' DDOS attacks?

I'm not sure how to proceed with protecting my server.

  • we don't know what's normal for your server: are the GETs and POSTs unusual? Are the requests coming from a wide range of IPs? We need a little more context.
    – schroeder
    Jan 15 '17 at 21:48
  • I googled the first part of the POST and got this: phabricator.wikimedia.org/T68225
    – schroeder
    Jan 15 '17 at 21:50
  • I'm sorry I didnt specify that the GETs and POSTs contained vulgar and clearly spamlike content! Thanks for the link!
    – Gravetow
    Jan 15 '17 at 22:22

If you have a server on the public internet, it will be scanned and probed. This is just a fact of life, and should inform the base of your security policy.

You are most likely going to primarily see three types of attacks:

  • Spammers will try to make comments on blogs, edit pages on wikis, and in general do anything they can to get links to their sites on yours.
  • People will run automated vulnerability scanners that try to exploit known vulnerabilities in outdated software and poor configurations. Sometimes this is a first step towards more destructive spamming (take over your site completely), sometimes it's to make you part of a botnet, sometimes it's just for the amusement.
  • Sometimes you'll just get plain ol' HTTP requests. These can be an attempt at a DoS attack, or a misconfigured bot, or a search engine spider, or someone archiving your site to read it offline, or an unexpected link to your site from reddit, or any number of other things. Whether the intention is good or not, if you're not prepared, this can make your site inaccessible.

It's fairly easy to mitigate most of what you'll see in all three of these categories:

  • Keep your software up to date.
  • Don't use anything that says "For development use only!" in production.
  • Install an anti-spam plugin for your blog commenting system.
  • Add full-page caching and rate-limiting, either yourself (e.g. with Varnish) or through a service like Cloudflare.

You'll see plenty of requests that won't do anything to you, because it's easy to tell a script to just try everything, rather than trying to figure out what exactly you're vulnerable to. For the most part, these can be ignored, but keep an eye on your site to make sure a spammer doesn't get in and wreak havoc for months before you notice.

  • Thank you very much for you answer! I'm quite sure it was the first point : spammers that tried to make posts / profiles and link to it.
    – Gravetow
    Jan 15 '17 at 22:23

There is another risk.

In past years an open MediaWiki could be used to boost SEO as spam would then link back to pages hosted on your Wiki, which could be deleted after growing to some arbitrary size. You would then have broken links coming back to you for years to come as old email or forum spam is reviewed.

Google take a very dim view of this nowadays, and may actively push you down in search results.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.