Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am seeing a lot of requests where users are trying to request PhPMyAdmin directory on my web-server and I would like to put an end to it. They try a few different directories like PhpMyAdmin-2.10 or just PhpMyAdmin or just PhpMyAdmin-2.09

Would Apache Re-write rule be the best thing to re0direct them to a blackhole that bans their IP from accessing the IP again?

Or

I could simply create these directories and put in a javascript redirect to black-hole them as well.

Thoughts on a good solution are appreciated.

EDIT: Here is what I am doing in .htaccess

RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_URI} ^/phpmyadmin [NC,OR]
RewriteCond %{REQUEST_URI} ^/admin [NC,OR]
RewriteCond %{REQUEST_URI} ^/dbadmin [NC,OR]
RewriteCond %{REQUEST_URI} ^/mail [NC,OR]
RewriteCond %{REQUEST_URI} ^/myadmin [NC,OR]
RewriteCond %{REQUEST_URI} ^/mysql [NC,OR]
RewriteCond %{REQUEST_URI} ^/php\-my\-admin [NC,OR]
RewriteCond %{REQUEST_URI} ^/pma [NC,OR]
RewriteCond %{REQUEST_URI} ^/webmail [NC]
RewriteRule .* http://%{REMOTE_ADDR}%{REQUEST_URI} [R=301]
share|improve this question
    
I'd go with either rewrite or putting your ban script directly at the URLs being requested. Whoever is hitting it is probably using an automated scanner rather than a webbrowser with javascript support, and wouldn't obey a javascript redirect. –  DerfK Dec 28 '10 at 0:36
add comment

2 Answers

up vote 3 down vote accepted

You could waste their time - which may do more to prevent them from scanning the internet as a whole than banning their IP would:

RewriteEngine on
RewriteBase /
RewriteCond %{REQUEST_URI} ^/phpmyadmin [NC]
RewriteRule .* http://%{REMOTE_ADDR}%{REQUEST_URI} [R=301]

Update: To add directories or files you can add additional conditions (be careful not to block search spiders, etc)...

Update x2: Added the Last and QueryStringAppend flags, commented desirable location for additional rules.

RewriteEngine on

RewriteBase /

RewriteCond %{REQUEST_URI} ^/phpmyadmin [NC,OR]
RewriteCond %{REQUEST_URI} ^/admin [NC,OR]
RewriteCond %{REQUEST_URI} ^/dbadmin [NC,OR]
RewriteCond %{REQUEST_URI} ^/mail [NC,OR]
RewriteCond %{REQUEST_URI} ^/myadmin [NC,OR]
RewriteCond %{REQUEST_URI} ^/mysql [NC,OR]
RewriteCond %{REQUEST_URI} ^/php\-my\-admin [NC,OR]
RewriteCond %{REQUEST_URI} ^/pma [NC,OR]
RewriteCond %{REQUEST_URI} ^/webmail [NC]
RewriteRule .* http://%{REMOTE_ADDR}%{REQUEST_URI} [L,R=301,QSA]

#
# any other rewrite conditions and rules here
#
share|improve this answer
    
@danielfree - if I wanted to add more rewrite rules for similar things. I would just add additional RewriteCond and RewriteRule lines, correct? –  AXL Dec 28 '10 at 3:40
    
@AXL - You would need to add the "OR" flag - updating answer accordingly –  danlefree Dec 28 '10 at 3:58
    
@danlefree - I am doing something wrong. in httpd.conf I do RewriteEngine on and in the <virtual host> I do RewriteEngine On and RewriteOptions Inherit. I then create a .htaccess in the directory the <virtual host> uses for DocumentRoot but when I try and hit <domain>/phpmyadmin I get a 404 rather than a 301. Edited the above question to show what I am doing in .htaccess. –  AXL Dec 28 '10 at 18:54
    
@AXL - Sorry, was missing the leading slash in the example (for your rules to work you'll need to add the leading slash for rules like ^/phpmyadmin and you'll want to escape the dash character for rules like ^/php\-my\-admin - otherwise that should work. –  danlefree Dec 28 '10 at 23:20
    
@danlefree - OK, I tried that, even restarted apache and I am still getting a 404 –  AXL Dec 29 '10 at 0:00
show 6 more comments

ModSecurity or fail2ban is what my research led me to.

There is also this question: How to thwart PHPMyAdmin attacks?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.