0

Our website was behaving strangely.

  • Sometime it was down and nothing was accessible.
  • Sometime it started loading but pages browsing was too slow.

We checked apache logs and found the below suspicious entries:

[Fri Dec 28 00:47:47 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/css
[Fri Dec 28 00:47:47 2018] [error] [client 212.237.1.209] script '/usr/share/phpMyAdmin/config.user.inc.php' not found or unable to stat
[Fri Dec 28 00:47:47 2018] [error] [client 212.237.1.209] script '/usr/share/phpMyAdmin/config_inf.php' not found or unable to stat
[Fri Dec 28 00:47:47 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/4.2
[Fri Dec 28 00:47:48 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/scripts
[Fri Dec 28 00:47:48 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/config
[Fri Dec 28 00:47:48 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/scripts
[Fri Dec 28 00:47:48 2018] [error] [client 212.237.1.209] File does not exist: /usr/share/phpMyAdmin/config
[Fri Dec 28 01:03:28 2018] [error] [client 115.159.111.47] File does not exist: /usr/share/phpMyAdmin/scripts
[Fri Dec 28 01:03:28 2018] [error] [client 115.159.111.47] File does not exist: /usr/share/phpMyAdmin/scripts
[Fri Dec 28 01:03:28 2018] [error] [client 115.159.111.47] File does not exist: /usr/share/phpMyAdmin/scripts
[Fri Dec 28 01:03:28 2018] [error] [client 115.159.111.47] File does not exist: /usr/share/phpMyAdmin/scripts

Our quick backup response was to block these IP-addresses

Moreover we also found the below entries in logs:

[Mon Dec 24 07:17:26 2018] [error] [client 91.121.134.18] Empty module and/or action after parsing the URL "/api/ip.php" (/).

Detail about above log entry: https://www.abuseipdb.com/check/91.121.134.18?page=2#report. We also blocked these IP-addresses

I want to know what was going on? Was it a DDOS attack or something else? For now I have blocked the suspicious IPs.

However what is the permanent solutions/tricks to limit/end these type of attacks?

1

My own apache logs are stored in:

/var/log/apache2/*.log

Typically each virtual host has its own access log, such as:

  1. /var/log/apache2/vhost1_access.log
  2. /var/log/apache2/vhost2_access.log

The entries are very similar to many entries in my own log files. The IP addresses listed in your question each have been tagged by other web servers, probably automatically by programs such as fail2ban. At least one IP address was tagged as using zmeu scanner.

Most these types of log entries indicate what I would describe as the low to medium hum of the open Internet; meaning automated bots looking for low hanging fruit in all corners of the IPv4 address space.

If your particular corner of the Internet is chosen by several scanners simultaneously, your small low-traffic server may experience some heavier than normal load.

Generally, I check:

  1. The last command in order to make sure that I recognize all entries.
  2. The lastb command in order to check how many username/password combinations have been attempted for the day.
0

The above logs don't seem suspicious at all. You should, in addition, check your access log for suspicious activities. You can filter suspicious activities looking at request line, Referrer, User-Agent and most-importantly time. Usually, suspicious requests come in no time difference, you would notice a sequence of requests- which have something in common. They, mostly, would be from same IP address and/or User-Agent.
Also, as a developer/user of the application, you can sometimes be sure of request line. So, you would mostly be looking for POST requests. For example, a GET request without any parameters to a known file could be ignored.

And from what you're describing, it looks like your server is low on resource. You can check your resource usage to be sure. This is a very common issue if you're using a CMS on a low spec VPS.

  • Where is access logs located normally? – Iftikhar uddin Dec 29 '18 at 16:56
  • 1
    They're usually under /var/log/ directory. You can easily grep for /var/log/ on your config file and find it. For example, if you're using Apache, you could do like; grep -F '/var/log/' /etc/httpd/conf/httpd.conf. – 1lastBr3ath Dec 29 '18 at 17:00
  • in var/log i have apache_errors.log and in root php_errors.log. BUT i didn't found any access logs! I also got these entries from logs [Sun Dec 23 02:51:46 2018] [error] [client 31.163.129.232] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /maker/snwrite.cgi [Sun Dec 23 07:02:59 2018] [error] [client 212.83.145.238] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): / – Iftikhar uddin Dec 29 '18 at 17:06
  • Can you not find your config files? It should be somewhere inside /etc/httpd/ or /etc/apache2/ or /opt/. The default configuration does have access log, afaik. The error about missing hostname, it's just that HTTP/1.1 requires host header be present. And about empty module, I'm not sure what it does but it seems to be expecting a module/action from /api/ip.php. – 1lastBr3ath Dec 29 '18 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.