Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Since a few days my apache webserver is under attack. I get multiple requests to non-existant pages from multiple IP's. Is there anything I can do to stop it besides shutting down my apache server?

Currently I have closed port 80 to stop the logs filling up. Here is a part of my error.log:

[Tue Aug 16 17:12:55 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/view.aspx, referer: http://www.gamesfox.info/
[Tue Aug 16 17:12:55 2011] [error] [client xxx.xxx.xxx.xxx] script '/var/www/login.php' not found or unable to stat, referer: http://www.wi8357.com/login.php
[Tue Aug 16 17:12:55 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/addyn, referer: http://www.dodomains.net
[Tue Aug 16 17:12:55 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.addictedpeople.com
[Tue Aug 16 17:12:56 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/toindex1.asp, referer: http://98.126.93.27/toindex1.asp
[Tue Aug 16 17:12:56 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.zopm.com
[Tue Aug 16 17:12:56 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.zopm.com
[Tue Aug 16 17:12:56 2011] [error] [client xxx.xxx.xxx.xxx] script '/var/www/xml.php' not found or unable to stat
[Tue Aug 16 17:12:56 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/config
[Tue Aug 16 17:12:57 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/addyn, referer: http://www.hypeshot.com
[Tue Aug 16 17:12:57 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/toindex1.asp, referer: http://98.126.93.27/toindex1.asp
[Tue Aug 16 17:12:57 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/addyn, referer: http://www.gkkv.com
[Tue Aug 16 17:12:57 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.iyens.com
[Tue Aug 16 17:12:57 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.titist.com
[Tue Aug 16 17:12:57 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.yfia.com
[Tue Aug 16 17:12:58 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/addyn, referer: http://www.abundancegames.com
[Tue Aug 16 17:12:58 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.chiefwork.com
[Tue Aug 16 17:12:58 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/pp, referer: http://www.thirdgames.com
[Tue Aug 16 17:12:58 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/toindex1.asp, referer: http://98.126.93.27/toindex1.asp
[Tue Aug 16 17:12:58 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.newbiegamer.com
[Tue Aug 16 17:12:58 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://luxuryup.com
[Tue Aug 16 17:12:59 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.monopolyfreegame.com
[Tue Aug 16 17:12:59 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/pp, referer: http://luxuryup.com/
[Tue Aug 16 17:13:02 2011] [error] [client xxx.xxx.xxx.xxx] script '/var/www/login.php' not found or unable to stat, referer: http://www.wi8357.com/login.php
[Tue Aug 16 17:13:02 2011] [error] [client xxx.xxx.xxx.xxx] script '/var/www/index.php' not found or unable to stat, referer: http://www.fire35.com

They are all different IP's, so my brute-force protection in iptables does not help.

Any suggestions?

share|improve this question
1  
This is no attack but referrer spamming. –  cweiske Aug 17 '11 at 19:48
    
so any way to stop this 'spamming' ? –  Goez Aug 17 '11 at 19:54

2 Answers 2

up vote 5 down vote accepted

I was googling around, and found this :

http://mediakey.dk/~cc/block-referer-spam/

It seems there is a special module for apache2 to prevent referrer spam.

or

A more manual method with iptables :

http://www.iospirit.com/blog/article/12/Linux-HowTo-Defeating-referer-spam/

share|improve this answer

If you want your server public there will be no way to stop it completely, but what you can do is use mod_evasive to intelligently block hosts making too many requests and/or mod security to match patterns and block hosts based on patterns.

Likely these will go away eventually

share|improve this answer
1  
Any public webserver will be hit by waves of crap requests. The way to stop this is to not have your server publicly accessible. Barring that my best additional advice is not to obsessively read your webserver logs -- Look at them when you need to troubleshoot something. –  voretaq7 Aug 17 '11 at 20:24
    
use logwatch and scan for odd patterns, and yes - 'agree' don't obsess over it or you will be tweaking for hours every day –  Sean Kimball Aug 17 '11 at 20:28
    
logwatch or something similar is a great tool, but be wary of a low signal-to-noise ratio (or missing legit attacks) if not configured properly. Getting real value from log watch is hit-or-miss and demands appropriate tuning. –  voretaq7 Aug 18 '11 at 3:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.