0

I have an attack coming to a specific path repeatedly - every 10 minutes or so, the same exact address gets pinged.

I know this because I keep getting an error message in my Drupal logs about an attempt to access a page that does not exist.

sites/default/files/cache.php

How do I ban attempted connections to this address? I have IPtables enabled, I have various Drupal modules set to report and ban unusual traffic (but for some reason this gets through), and the file doesn't even exist.

1
  • iptables -p tcp -s 1.2.3.4 -j DROP Mar 20, 2015 at 13:13

1 Answer 1

1

If you just want to block a specific IP:

iptables -A INPUT -s 1.2.3.4 -j DROP

You can't reject a TCP connection which has the later intent of visiting a particular URL, because the TCP connection has to be made before that information can be transferred.

To be honest, I wouldn't worry about it. It's probably a drive-by attack against a random plugin or CMS that you don't have. If your server is responding with a 404, there's not much you can do in response. There's no real security threat to mitigate here.

That being said, you could look into installing mod_security to provide some generic blanket security protection against drive-by attacks.

1
  • If you need to block a large quantity of IPs, an IPset will be more efficient than separate firewall rules.
    – user42178
    Mar 20, 2015 at 15:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .