Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have number of such records in my Apache log:

[Tue Dec 20 01:31:45 2011] [error] [client 192.0.79.172] File does not exist: /var/www/user/data/www/example.com/phpMyAdmin-2.5.4

Where 192.0.79.172 is my server external IP address configured on eth0. Clearly, someone is scanning server on subject of phpmyadmin vulnerabilities. But why all such logs entries show my own server IP address not the attacker? I would like to block such scans. I feel I'm missing something. I use CentOS 5.7 if it matters.

Thank you.

UPDATE

grep  proxy /etc/httpd/conf/httpd.conf 

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
# enable the proxy server:
#<IfModule mod_proxy.c>
#   CacheRoot "/var/cache/mod_proxy"
# End of proxy directives.

I should have mentioned that I have nginx before Apache, but that does not change anything. The same situation had occurred before we deployed nginx as a reverse-proxy.

share|improve this question
    
It seems that the attacks are occuring from your own server, are their clients on your server ? –  Lucas Kauffman Jan 17 '12 at 15:18
    
does grep -d proxy /path/to/httpd.conf return anything? –  Chris S Jan 17 '12 at 15:18
    
Yes, we have one user and one site. Should I do malware scan? –  Andrew Jan 17 '12 at 15:24
1  
I'd go what Chris suggests, just bear in mind it might be your user performing a PMA scan with a script, it would not turn up as malware. It might be your system is compromised in one way or another. –  Lucas Kauffman Jan 17 '12 at 15:31
1  
Definitely have mod_proxy loaded, and it looks like it might be enabled too though that specific directive isn't in the above output. Is there a reason you've got Apache acting as a proxy? It's very easy to create a mod_proxy configuration where it's open for anyone to use as an open proxy. –  Chris S Jan 17 '12 at 15:35

2 Answers 2

up vote 2 down vote accepted

With default setup you will always have your server IP in Apache logs, because Nginx is a client here. You can try adding some options to Nginx to pass real IP:

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

Or you can enable and examine Nginx logs.

share|improve this answer
    
Forgive me my stupidity, yes I have checked nginx access log and the attacker IP is clearly seen. –  Andrew Jan 17 '12 at 15:44

Sounds like you need mod_rpaf. I answered a question on this a few minutes ago.

The phpMyAdmin scans are fairly normal. If you have phpMyAdmin installed you should restrict access to it using either HTTP Basic Auth or an IP address restriction and if you don't have it installed these will just be harmless 404s.

You can also find the original IP address in your nginx logs.

share|improve this answer
    
Thank you for advice. –  Andrew Jan 17 '12 at 16:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.