Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Long story short we recently had an account on one of a shared hosts compromised, the issue has been resolved but the affected account is still being spammed with over a million requests a day to a specific file.

Since the compromising file is gone all requests are met with Apache's minimalistic 404 page, weighing in at about 521bytes. Problem is 512bytes * 1M+ requests is not only taking a toll on our servers performance but is wasting gigs of bandwidth a day.

  • The attacks from from hundreds of IP so blocking individual IPs isn't feasible.
  • All the requests are POST requests to the same file, lets call it "evil.php".

We tried briefly using a RewriteRule and forbidding all requests to evil.php but this showed a forbidden page leaving us where we started.

Ideally we want just drop the requests to "evil.php" and return nothing. Essentially stop Apache from responding. Is this possible and how?

Edit

Let assume for the sake of this exercise there is no shell access and all solutions must be implementable via a cPanel like interface. Although this isn't the case here, our freedom to make configuration changes to the server is small beyond LAMP stack, DNS (bind), and Mail configurations.

share|improve this question

3 Answers 3

up vote 2 down vote accepted

mod_security, action "drop".

[pad chars for serverfault]

share|improve this answer
    
+1 for the pad chars (also: thanks!) –  Jan Apr 3 '12 at 7:26

What if you replaced "evil.php" with a zero-length file? At least in my install of Apache 2.2 that takes up only about 206 bytes (HTTP headers). A 404 takes up about 500 bytes. That would at least cut your traffic in half. For more advanced blacklisting, check out:

http://perishablepress.com/press/2009/02/03/eight-ways-to-blacklist-with-apaches-mod_rewrite/

share|improve this answer
    
That's an interesting idea. Do you know of a way to prevent Apache returning headers as well? Think you posted was interesting, but didn't help this current issue, I'll definitely keep it around though thank you. –  xzyfer Jan 26 '11 at 5:48

You can create the evil.php file and host it on apache and return empty content (similar to Markus suggestion). At the same time, you can save the requesting IP in a text file. This text file can then by read by a script to add all these IPs to iptables rule to drop all future requests. This way you can collect all requesting IPs and stop them.

share|improve this answer
    
We considered something similar to this, but we don't have access to ip tables or much else beyond LAMP stack, DNS (bind) and Mail configurations. –  xzyfer Jan 26 '11 at 8:20
    
If you don't have access to a local or remote firewall. Then, you should coordinate with the responsible people and they should help! –  Khaled Jan 26 '11 at 8:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.