Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have many errors in log file like:

[Tue Jul 19 09:56:45 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/xqxsmirserver6.rar
[Tue Jul 19 09:56:45 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/mirserver6.rar
[Tue Jul 19 09:56:46 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/mirserver6.rar
[Tue Jul 19 09:56:46 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/vqkbmirserver7.rar
[Tue Jul 19 09:56:46 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/mirserver7.rar
[Tue Jul 19 09:56:47 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/mirserver7.rar
[Tue Jul 19 09:56:47 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/pebv12.rar
[Tue Jul 19 09:56:48 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/12.rar
[Tue Jul 19 09:56:48 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/12.rar

I believe that these errors is from attacker which try to get the backdoor file. How can I prevent these access or block attackers, they might change IP very fast.

share|improve this question
add comment

2 Answers

Fundamentally, you can't -- you have no control over what URLs someone might choose to randomly request from your server.

However, you can do various things to mitigate the effects of people randomly guessing at URLs, such as rate limiting, automatically (or manually) blocking IP addresses and ranges that you detect acting in a way you don't wish to allow, or playing various forms of silly-buggers (such as tarpitting persistent abusers).

Without knowing what you want to achieve, there's a limit to how much detail (in suggested solutions and implementation detail) anyone can give. You might want to tightly define what you want to stop (and how you'd like to do it, what collateral damage you're willing to incur, and so on), then ask that as a separate question.

share|improve this answer
    
Thanks for your answers! I think about using htaccess to block all "rar" files in root folder But it also block other "*.rar" files in sub folder I'm still finding the solution Block IPs is not good choice as attacker can use fakes IP. –  user88063 Jul 20 '11 at 11:34
add comment

If they seem to be coming from the same subnet, you may be able to block that IP or subnet from within your router/ firewall.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.