Just this week someone has been trying to attack the server of the company where I work. I have noticed that they have been trying to brute force root via ssh. fail2ban is handling that well and I never allowed password logins for root in the first place so that's not really a problem but they have been after our website too.

We use the Laravel PHP framework which has some pretty verbose errors. They must have at least found a full path disclosure hole by now. I have inspected the mod_security logs and it seems that they are just running a security scanner on us. They have been trying a bunch of exploits for software we don't actually have installed. Anyway, they have been at if for almost a week now and I'm beginning to become worried.

What is the best thing to do right now? The attacks are not that sophisticated but are attacks none the less. How do I convince my boss and coworkers that whatever actions we have to take are necessary?

  • 1
    Are they coming from multiple IP addresses, or one consistent IP?
    – David
    Commented Mar 16, 2014 at 19:13
  • They are coming from multiple IPs from China. I think they're proxies.
    – 735Tesla
    Commented Mar 16, 2014 at 19:49
  • 2
    Ok interesting addition: after some googling I discovered that some of the addresses are of zombies part of a botnet
    – 735Tesla
    Commented Mar 16, 2014 at 22:38
  • Can you stand up an NDIS appliance in front of your site, or configure your router to block the IPs that attempt to scan it? If the bots can't get to it at all, the bot-herder might give up. Commented Mar 16, 2014 at 23:46
  • Well the problem is not that I actually fear a breach. So far mod_security has blocked everything and I made it so errors don't display any data. An NDIS appliance would be a good idea but I don't think the attacker is a huge threat at the moment. mod_security and fail2ban are doing their jobs pretty well. My question is more whether it should be temporarily taken offline or if there is something I should do to analyze the log files other than just reading them. Thanks for the suggestion though.
    – 735Tesla
    Commented Mar 16, 2014 at 23:49

4 Answers 4


Your best bet is to install a web application firewall like mod_security and apply rules to nip this in the butt. Apply Duo Security, to disallow unvalidated sudo commands from a compromised account.

fr00yl00p says:

  • Configure the system to alert you upon logins (e.g. per mail in sshrc and bashrc)

This becomes too cumbersome and complex if you have systems that perform maintenance, e,g, SNMPv3, any kind of rsync accounts, etc. A better mechanism would be an alias of the last command written to terminal whenever you log in. Duo will stop a lot so check it out.

fr00yl00p says:

Let your firewall drop connections with obvious attack patterns. (e.g. http://spamcleaner.org/en/misc/w00tw00t.html)

This is not a feasible mechanism and you'd have to create a whitelist in parallel. Consider the fact that I can spoof connections pretending to be anyone. Imagine I generate enough spoofed messages to simulate say a CIDR /16, /8, or even /2.

fr00yl00p says:

Install PHPIDS (https://phpids.org/)

Unless you're willing to become an incident response analyst, you will be wasting so much time chasing false positives, you'll eventually ignore the alerts from IDS' and IPS' even well trained DFIR people spent hours at a time constantly modifying. Let alone someone who isn't accustomed to using an IDS, nor interpreting its output.

As for other recommendations, you need not block entire ranges for a webserver if you configure a WAF properly. On one of my sites, I PURPOSEFULLY keep Joomla 1.5 running and worry nothing about compromises since my WAF is written to only allow a POST from my static address. Its simplicity at its finest. My website is designed ONLY to allow GETs not POSTs so there is no need to go bezerk on rules.

You need to also be cognizant, that much traffic is generated by infected machines, so you're not stopping or blocking an attacker per-se, you're blocking one infected machine. So I wouldn't go as far as blocking entire IP blocks to a webpage. Mailserver, ssh server sure. In fact, you should have a default "BLOCK ALL" to your webserver, ONLY allowing your address to services such as SSH. However, everyone's designs/needs differ

  • Thanks for the recommendation. I disabled password authentication for ssh completely would you still recumbent blocking addresses?
    – 735Tesla
    Commented Mar 17, 2014 at 20:40
  • It all depends on your level of security, and what you need to do. I wouldn't block connections to HTTP, but would block ALL to SSH allowing only in my addresses
    – munkeyoto
    Commented Mar 18, 2014 at 16:48
  • I think you misunderstood the "Let your firewall drop connections" part. The linked site is worth reading ;-) and yes, never go without mod_security. Very good point.
    – fr00tyl00p
    Commented Mar 19, 2014 at 1:21

Put the SSH behind the a firewall and require a VPN to access the box -- that cuts off one major attack vector and probably makes it trickier to exploit any application level penetration.


I would at least talk with your hosting company. They may have some ways to help, such as by blocking IP address ranges before they can reach you, perhaps they can also set you up with other defense layers.

  • We're hosting it ourselves and blocking as many as we can. They are using socks proxies.
    – 735Tesla
    Commented Mar 17, 2014 at 16:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .