0

I noticed in the logs that my server is beeing scanned continuously, I know that from apache / postfix/ dovecot logs.

Example from apache error log :

==> error.log <==
[Fri Mar 01 10:11:30.796076 2019] [:error] [pid 25454] [client ***MyIp***:11170] script '/var/www/html/cnm.php' not found or unable to stat
[Fri Mar 01 10:11:40.755692 2019] [:error] [pid 25182] [client ***MyIp***:14932] script '/var/www/html/51.php' not found or unable to stat
[Fri Mar 01 10:14:36.128821 2019] [:error] [pid 25513] [client ***MyIp***:25016] script '/var/www/html/cadre.php' not found or unable to stat
[Fri Mar 01 10:14:36.594905 2019] [:error] [pid 25513] [client ***MyIp***:25016] script '/var/www/html/mm.php' not found or unable to stat
[Fri Mar 01 10:14:37.082301 2019] [:error] [pid 25513] [client ***MyIp***:25016] script '/var/www/html/test.php' not found or unable to stat
[Fri Mar 01 10:14:38.201763 2019] [:error] [pid 25513] [client ***MyIp***:25016] script '/var/www/html/1q.php' not found or unable to stat
[Fri Mar 01 10:14:38.693411 2019] [:error] [pid 25513] [client ***MyIp***:25016] script '/var/www/html/1111.php' not found or unable to stat
[Fri Mar 01 10:14:39.142149 2019] [:error] [pid 25513] [client ***MyIp***:25016] script '/var/www/html/errors.php' not found or unable to stat
[Fri Mar 01 10:14:40.289652 2019] [:error] [pid 25513] [client ***MyIp***:25016] script '/var/www/html/q.php' not found or unable to stat
[Fri Mar 01 10:14:43.169735 2019] [:error] [pid 25513] [client ***MyIp***:25016] script '/var/www/html/index.php' not found or unable to stat

In addition to the risk of being hacked, these attacks generate too much logs !

Is there a way to stop them without affecting the "real" visitors ?

marked as duplicate by schroeder Mar 1 at 20:48

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • I think the only way is to block their IP. Is that something you can do? – schroeder Mar 1 at 20:41
  • Not always the same IP. but yes this sould at least eliminate temporarely some attackers. – Mehdi Mar 1 at 20:52
  • There are lots of ways to temporarily block "bad" IPs. Fail2ban and other tools do this for you. Many options are found in the duplicates I listed. – schroeder Mar 1 at 20:55
  • Ok I will check them. thanks . Indeed I have to use fail2ban as i saw SSH login attempts too. – Mehdi Mar 1 at 20:56