Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

just checked my Apache logs and stumbled upon this log: Client denied by server configuration. What I found weird, are the different phpMyAdmin versions. The IP is in Czech: http://whois.domaintools.com/188.120.221.206

Am I just too overcautious?

What specific can I do against it?

logs

share|improve this question

migrated from stackoverflow.com Mar 15 '10 at 18:26

This question came from our site for professional and enthusiast programmers.

1  
Not really program related is it? But yes, someone was running a script against your host. –  Dan McGrath Mar 15 '10 at 18:05
    
come on guys. every web developer, system admin, software engineer has to deal with security when programming. so securing you programs is programming related. I just thought that you programming geeks would know these types of attacks and be able to tell me what to do against it. –  Max Mar 15 '10 at 18:10
    
lot of that going around.I had the same thing happen to me - serverfault.com/questions/123175/… - if you have a ssh server, check its logs too –  Journeyman Geek Mar 17 '10 at 15:01

5 Answers 5

up vote 7 down vote accepted

I agree with Andrey. Its an attack from a random scanner bot. They crawl the internet (usually within a specified ip range) looking for known exploits on servers, then report their findings back to the wraith hive ship for culling.

Edit: Not sure why this post was deleted. In addition...

These scanner bots don't cause much of a problem unless you're running a version of apache with known exploits (many of these bots are programmed to detect buffer overflows and other web server software related bugs) or you have common tools in your web root (ie, phpMyAdmin). Keep all your web tools under lock-and-key (use apache's basic auth over https, pretty secure) and don't set your root password to 'cheese'.

Edit2: Post updated from SO.com

share|improve this answer

As the other posts here mention this is way too common nowadays to find on daily logs vulnerability scanners(crawlers), I recommend to set some spam traps and honeypots so you can help to catch this guys, and at the same time protect yourself using blacklists to ban them access directly from their IP on your server. Some months ago I found my self like you, I had lots of rows on my log like the following

195.140.144.30 - - [16/Aug/2011:00:49:33 +0300] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 239 "-" "ZmEu" 

The interesting issue was that all were 404 errors, first I decided to stop that adding ban to the agent ZmEu but that was not enough, searching and searching I found the Project Honeypot and found that it rocks! I wrote some small scripts for add some well known bandits on my deny list and the rest I left it to some code provided by them you can find them on Project Honeypot.

Also you can find on the net some good php scripts to create own blacklists and some .htaccess rules to deny access to most well known bad user agents.

If you install any Application from Open source or common PHP tools like php_my_admin , blogs, or CRMS, rename all their install(remove them if possible) and administration folders to something cryptic and use .httacess to set passwords.

Another thing is that you often review your logs ban the offending IPS.

A good example and reference is found here.

Due your web Server is public you must set some access rules if you want to avoid unwanted surprises.

On my personal experience all that effort has been well worth at least site traffic from those exploiters has diminished on the last 5 months.

Also I recommend you give this article a read.

share|improve this answer

A path or connection attempt violated the permission definitions set by your Apache configuration. As @Andrey said, usually this is an indication that someone is trying to find a way in. My best recommendation however, is to look for some of the Apache 2.x hardening guides and make sure you don't have any gaping holes.

Update: Now that you have your logs up, it looks like this person is trying to access you MyPHPAdmin. XAmmp, probably setup that those paths are only accessible by 'localhost', which in turn creates a permission denied for any external access. Either way, my previous recommendation still stands...

share|improve this answer
    
thx, those Apache 2.x hardening guides seam hard to read... –  Max Mar 15 '10 at 18:17
    
how can this person access path of my filesystem. in the browser? –  Max Mar 15 '10 at 18:18
    
c:\xampp\htdocs is your DocumentRoot - try the docs httpd.apache.org/docs/2.0/mod/core.html#documentroot –  Andy Mar 15 '10 at 18:56
    
With the assumption that XAMMP has set that path to be only accessible to 'localhost', in theory that path should not be accessible to anyone other than 'localhost'. I would verify the Apache configuration for that path for the server to make absolutely sure that this is the case. I understand that the Apache configuration is difficult to start working with. It's taken me years to get to a point where I can say I'm comfortable with it. However, the problem is that most security holes exist in servers set with default settings. –  Jason Mock Jul 20 '10 at 13:57

Maybe you can try the installation of "Fail2Ban" application to ban those IPs to reduce the risk...

share|improve this answer

This is internet background noise. My recommendation is to use an application like OSSEC or Fail2ban to automatically ban these types of attacks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.