Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have had a user trying to hack into my server and muieblackcat pops up on my server, quite a few times.

I just wanted to get some advice as to the best way to protect against this ie should i block the user via htaccess or should i block them via iptables alternatively is there a better way?

Please note that the server i am running is Centos 5.7 64bit

share|improve this question

4 Answers 4

up vote 1 down vote accepted

Blocking via iptables is better than blocking via htaccess. iptables will not let the hacker use any other port as well. He won't be able to create any connection. htacces comes into play later. Hacker can exploit any other port/service than http if you block only using htaccess.

iptables -A INPUT -j DROP -p all -s 123.123.123.123
iptables -A INPUT -j DROP -p all -s 123.123.123.123
share|improve this answer
    
thank you for the quick response :) Ps Happy new year –  Dino Dec 28 '11 at 18:00

If the "attack" is coming from a single IP you can drop the way back to that ip by blackhole-routing:

ip route add blackhole IP

That way his/her request will never get an answer.

share|improve this answer

While you can add an iptables rule to block that ip address, a better solution is to use fail2ban add rules for HTTP.

share|improve this answer

With any type of server, you definitely need to layer your security approach. Such as keeping the system fully patched, having least access controls in place, etc. If your seeing the muieblackcat hits in your logs, it's more than likely just a scanner hitting your system looking for php vulnerabilities (http://serverfault.com/questions/309309/what-is-muieblackcat). These types of scans will be very common for any external facing web server.

As far as blocking this IP, I would agree with Aditya as far as iptables is better than htaccess due to iptables blocking all traffic from that IP. You can also look into some other tools suck as fail2ban that can monitor log files and then create iptable block rules on the fly as it sees specific traffic hits such as too many failed password attempts.

share|improve this answer
    
thanks for the additional advice I will look into fail2ban. Ps. Happy new year –  Dino Dec 28 '11 at 18:01
    
Not a problem at all. Hope it works out for you. Happy new year to you as well. –  Eric Dec 28 '11 at 22:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.