how to prevent attacker search for file in my server

Question

I have many errors in log file like:

[Tue Jul 19 09:56:45 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/xqxsmirserver6.rar
[Tue Jul 19 09:56:45 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/mirserver6.rar
[Tue Jul 19 09:56:46 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/mirserver6.rar
[Tue Jul 19 09:56:46 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/vqkbmirserver7.rar
[Tue Jul 19 09:56:46 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/mirserver7.rar
[Tue Jul 19 09:56:47 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/mirserver7.rar
[Tue Jul 19 09:56:47 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/pebv12.rar
[Tue Jul 19 09:56:48 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/12.rar
[Tue Jul 19 09:56:48 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/12.rar

I believe that these errors is from attacker which try to get the backdoor file. How can I prevent these access or block attackers, they might change IP very fast.

Answer 1

Fundamentally, you can't -- you have no control over what URLs someone might choose to randomly request from your server.

However, you can do various things to mitigate the effects of people randomly guessing at URLs, such as rate limiting, automatically (or manually) blocking IP addresses and ranges that you detect acting in a way you don't wish to allow, or playing various forms of silly-buggers (such as tarpitting persistent abusers).

Without knowing what you want to achieve, there's a limit to how much detail (in suggested solutions and implementation detail) anyone can give. You might want to tightly define what you want to stop (and how you'd like to do it, what collateral damage you're willing to incur, and so on), then ask that as a separate question.

Answer 2

If they seem to be coming from the same subnet, you may be able to block that IP or subnet from within your router/ firewall.