0

I have made a website in Django 1.6 with PostgreSQL database which is hosted on Ubuntu 12.04.3 with Apache 2.2.22 and I have recently noticed lots of hacking (probing) attempts from various IPs constantly every day which fills my inbox with reports which starts to being just annoying.

Some excerpts from server requests (paths and IPs are masked):

 'PATH_INFO': u'/myadmin/scripts/setup.php',
 'PATH_TRANSLATED': '/path/to/my/project/project.wsgi/myadmin/scripts/setup.php',
 'QUERY_STRING': '',
 'REMOTE_ADDR': 'XXX.XXX.XXX.XXX',
 'REMOTE_PORT': '62637',
 'REQUEST_METHOD': 'GET',
 'REQUEST_URI': '/myadmin/scripts/setup.php',



 'PATH_INFO': u'/phpTest/zologize/axa.php',
 'PATH_TRANSLATED': '/path/to/my/project/project.wsgi/phpTest/zologize/axa.php',
 'QUERY_STRING': '',
 'REMOTE_ADDR': 'XXX.XXX.XXX.XXX',
 'REMOTE_PORT': '60853',
 'REQUEST_METHOD': 'GET',
 'REQUEST_URI': '/phpTest/zologize/axa.php',



 'PATH_INFO': u'/pma/scripts/setup.php',
 'PATH_TRANSLATED': '/path/to/my/project/project.wsgi/pma/scripts/setup.php',
 'QUERY_STRING': '',
 'REMOTE_ADDR': 'XXX.XXX.XXX.XXX',
 'REMOTE_PORT': '64751',
 'REQUEST_METHOD': 'GET',
 'REQUEST_URI': '/pma/scripts/setup.php',


 'CSRF_COOKIE': u'bmbTHkbfWOeldHyAWBwj6rLb2yEopMnZ',
 'PATH_TRANSLATED': '/path/to/my/project/project.wsgi/HNAP1/',
 'QUERY_STRING': '',
 'REMOTE_ADDR': 'XXX.XXX.XXX.XXX',
 'REMOTE_PORT': '57303',
 'REQUEST_METHOD': 'GET',
 'REQUEST_URI': '/HNAP1/',

In some way, I am not concerned with those attempts since they are mostly checking for php vulnerabilities (as far as I have noticed), but I'd like to do something about it more than only fail2ban those IPs.

Since this is the first time I am struggling with this, I'd like to be sure that my web server is really secured enough and I wonder what could I do to be sure that those bots won't do any harm to my web site and database. The information in db itself is not so extra-important and even if someone get a copy of it no one will be hurt, but still... :)

So, my questions are:

1) Is my website and database really "safe" so far since I am not serving any PHP sites on it?
2) Is there anything I can do with Python/Django to gather more info about this attempt except the IP/PORT and PATH they were requesting (e.g. to get the source of the actual script which a "person" tried to run)?
3) Is there any list of very well known IPs which are used for scanning such vulnerabilities so I can automatically update my banned IPs list?
4) Is there any service where I could report IPs which I collected?
5) What are the best practices in general to make your website/server safe from not only those scripts, but any other common penetration attempts (I am aware there may be tons of various attempts, but I'm curious about my specific server configuration only - Django/PostgreSQL/Apache/Ubuntu)?

Thank you very much for any help and tips regarding this!

1 Answer 1

0

You can for example use mod_security to limit a volume of probe requests from single IP address.

Something like this:

LoadModule security2_module modules/mod_security2.so

<IfModule !mod_unique_id.c>
        LoadModule unique_id_module modules/mod_unique_id.so
</IfModule>

SecRuleEngine On
SecRequestBodyAccess Off
SecResponseBodyAccess Off
SecTmpDir /var/lib/mod_security
SecDataDir /var/lib/mod_security

SecRule REQUEST_URI "\.php$" id:1,phase:request,initcol:IP=%{REMOTE_ADDR},pass,nolog
SecRule IP:COUNTER "@gt 5" d:2,phase:request,t:none,setvar:IP.COUNTER=+1,expirevar:IP.COUNTER=900,deny,status:503,nolog
SecRule REQUEST_URI "\.php$" id:3,phase:request,t:none,setvar:IP.COUNTER=+1,expirevar:IP.COUNTER=900,nolog

This would return 503 Service Unavailable to any IP which tried to access URI with .php more than 5 times, with less that 15 minutes pause between tries.

Don't do this if you have anything running on PHP on your server.

1
  • Warning: untested.
    – Tometzky
    Mar 25, 2014 at 23:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .