0

I have an attack coming to a specific path repeatedly - every 10 minutes or so, the same exact address gets pinged.

I know this because I keep getting an error message in my Drupal logs about an attempt to access a page that does not exist.

sites/default/files/cache.php

How do I ban attempted connections to this address? I have IPtables enabled, I have various Drupal modules set to report and ban unusual traffic (but for some reason this gets through), and the file doesn't even exist.

  • iptables -p tcp -s 1.2.3.4 -j DROP – Hrvoje Špoljar Mar 20 '15 at 13:13
1

If you just want to block a specific IP:

iptables -A INPUT -s 1.2.3.4 -j DROP

You can't reject a TCP connection which has the later intent of visiting a particular URL, because the TCP connection has to be made before that information can be transferred.

To be honest, I wouldn't worry about it. It's probably a drive-by attack against a random plugin or CMS that you don't have. If your server is responding with a 404, there's not much you can do in response. There's no real security threat to mitigate here.

That being said, you could look into installing mod_security to provide some generic blanket security protection against drive-by attacks.

  • If you need to block a large quantity of IPs, an IPset will be more efficient than separate firewall rules. – user42178 Mar 20 '15 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.