Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have an attack coming to a specific path repeatedly - every 10 minutes or so, the same exact address gets pinged.
I know this because I keep getting an error message in my Drupal logs about an attempt to access a page that does not exist.
sites/default/files/cache.php
How do I ban attempted connections to this address? I have IPtables enabled, I have various Drupal modules set to report and ban unusual traffic (but for some reason this gets through), and the file doesn't even exist.
If you just want to block a specific IP:
iptables -A INPUT -s 1.2.3.4 -j DROP
You can't reject a TCP connection which has the later intent of visiting a particular URL, because the TCP connection has to be made before that information can be transferred.
To be honest, I wouldn't worry about it. It's probably a drive-by attack against a random plugin or CMS that you don't have. If your server is responding with a 404, there's not much you can do in response. There's no real security threat to mitigate here.
That being said, you could look into installing mod_security to provide some generic blanket security protection against drive-by attacks.
