5

I have a Linux web server running Rails and each time I check the Nginx logs I find attempts to access PHPMyAdmin, database and admin directories such as this:

190.196.161.110 - - [16/Oct/2011:23:37:31 +0100] "GET //PHPMyAdmin/ HTTP/1.1" 404 728 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"

The attacks are coming from a variety of different IP addresses and they just increment version numbers and check each directory, e.g. GET //PHPMyAdmin 1.0/, GET //PHPMyAdmin 1.1/ etc.

Will this affect the performance of my web server much? Also, is there a way to automatically ban IP addresses that do such things e.g. like fail2ban for ssh log-in attempts.?

10

If you're using Apache for such applications, you may want to look into ModSecurity, mod_evasive and/or mod_qos. The latter two are more geared towards brute force and DoS attacks. ModSecurity though has a ton of stuff under its banner.

3

Fail2ban has an example script for doing this from Apache log files. Basically look for the PHPMyAdmin string in your logs with a 404.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.