0

I have number of such records in my Apache log:

[Tue Dec 20 01:31:45 2011] [error] [client 192.0.79.172] File does not exist: /var/www/user/data/www/example.com/phpMyAdmin-2.5.4

Where 192.0.79.172 is my server external IP address configured on eth0. Clearly, someone is scanning server on subject of phpmyadmin vulnerabilities. But why all such logs entries show my own server IP address not the attacker? I would like to block such scans. I feel I'm missing something. I use CentOS 5.7 if it matters.

Thank you.

UPDATE

grep  proxy /etc/httpd/conf/httpd.conf 

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
# enable the proxy server:
#<IfModule mod_proxy.c>
#   CacheRoot "/var/cache/mod_proxy"
# End of proxy directives.

I should have mentioned that I have nginx before Apache, but that does not change anything. The same situation had occurred before we deployed nginx as a reverse-proxy.

Improve this question
5
  • It seems that the attacks are occuring from your own server, are their clients on your server ?
    – Lucas Kauffman
    Jan 17, 2012 at 15:18
  • does grep -d proxy /path/to/httpd.conf return anything?
    – Chris S
    Jan 17, 2012 at 15:18
  • Yes, we have one user and one site. Should I do malware scan?
    – Andrew
    Jan 17, 2012 at 15:24
  • 1
    I'd go what Chris suggests, just bear in mind it might be your user performing a PMA scan with a script, it would not turn up as malware. It might be your system is compromised in one way or another.
    – Lucas Kauffman
    Jan 17, 2012 at 15:31
  • 1
    Definitely have mod_proxy loaded, and it looks like it might be enabled too though that specific directive isn't in the above output. Is there a reason you've got Apache acting as a proxy? It's very easy to create a mod_proxy configuration where it's open for anyone to use as an open proxy.
    – Chris S
    Jan 17, 2012 at 15:35

2 Answers 2

Reset to default
2

With default setup you will always have your server IP in Apache logs, because Nginx is a client here. You can try adding some options to Nginx to pass real IP:

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

Or you can enable and examine Nginx logs.

Improve this answer
1
  • Forgive me my stupidity, yes I have checked nginx access log and the attacker IP is clearly seen.
    – Andrew
    Jan 17, 2012 at 15:44
1

Sounds like you need mod_rpaf. I answered a question on this a few minutes ago.

The phpMyAdmin scans are fairly normal. If you have phpMyAdmin installed you should restrict access to it using either HTTP Basic Auth or an IP address restriction and if you don't have it installed these will just be harmless 404s.

You can also find the original IP address in your nginx logs.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .