0

I have had a user trying to hack into my server and muieblackcat pops up on my server, quite a few times.

I just wanted to get some advice as to the best way to protect against this ie should i block the user via htaccess or should i block them via iptables alternatively is there a better way?

Please note that the server i am running is Centos 5.7 64bit

4 Answers 4

1

Blocking via iptables is better than blocking via htaccess. iptables will not let the hacker use any other port as well. He won't be able to create any connection. htacces comes into play later. Hacker can exploit any other port/service than http if you block only using htaccess.

iptables -A INPUT -j DROP -p all -s 123.123.123.123
iptables -A INPUT -j DROP -p all -s 123.123.123.123
0
1

With any type of server, you definitely need to layer your security approach. Such as keeping the system fully patched, having least access controls in place, etc. If your seeing the muieblackcat hits in your logs, it's more than likely just a scanner hitting your system looking for php vulnerabilities (What is muieblackcat?). These types of scans will be very common for any external facing web server.

As far as blocking this IP, I would agree with Aditya as far as iptables is better than htaccess due to iptables blocking all traffic from that IP. You can also look into some other tools suck as fail2ban that can monitor log files and then create iptable block rules on the fly as it sees specific traffic hits such as too many failed password attempts.

2
  • thanks for the additional advice I will look into fail2ban. Ps. Happy new year
    – Dino
    Dec 28, 2011 at 18:01
  • Not a problem at all. Hope it works out for you. Happy new year to you as well.
    – Eric
    Dec 28, 2011 at 22:46
0

While you can add an iptables rule to block that ip address, a better solution is to use fail2ban add rules for HTTP.

0

If the "attack" is coming from a single IP you can drop the way back to that ip by blackhole-routing:

ip route add blackhole IP

That way his/her request will never get an answer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .