Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a CentOS 5.8 server with Apache 2.2.3 with 20 websites on it. The last weeks the server was several times inaccessible (too many database connections and lots of CPU usage). I had to restart the server again to get ssh/ftp/http access again. When I checked the httpd log files of the server I see 10.000 'access attempts' every day coming via yourthumbnails.com. Here an example of the access log:

98.224.147.78 - - [19/Apr/2012:14:20:06 +0200] 
"GET /yourthumbnails.com/?id=2&%20121 HTTP/1.1" 404 278 "http://yourthumbnails.com/tgp44.html" 
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB7.1; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30618; WinNT-PAI 23.10.2009)"

And the error log

[Thu Apr 19 14:19:15 2012] [error] [client 24.3.144.129] 
File does not exist: /var/www/vhosts/default/htdocs/yourthumbnails.com, referer: 
http://yourthumbnails.com/tgp44.html

As you can see yourthumbnails.com is the referrer and the actual visitors all have different ip adresses. So I'm not able to block just one ip address.

I've searched Google how to block a referrer, but that seems to be very difficult. One method is to do it via htaccess like this:

RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} ^http://(www\.)?yourthumbnails\.com
RewriteRule .* - [F]

However, I looked in the individual httpd access log of all my sites and can't find one where yourhtumbnails is in. So it looks like my server is being attacked directly? And I can't use the htaccess method.

My question: Is there a way to block this kind of 'referrer attack' on the server without using a lot of server resources?

I've contacted my provider and even they can't come up with a solution. So I would be very happy if someone here has an idea.

share|improve this question

migrated from stackoverflow.com Apr 21 '12 at 9:58

This question came from our site for professional and enthusiast programmers.

1 Answer 1

up vote 2 down vote accepted

I looked in the individual httpd access log of all my sites and can't find one where yourhtumbnails is in

But is being reported in the error log. Looks like you're just not writing referer to the access log.

However it doesn't solve the problem you are describing - the request you show is causing a 404 response - this should not result in lots of database connections (unless you've got some smarts in the 404 handler), it should require a lot less effort for the webserver to handle this than to handle a valid request.

So either there's other stuff going on which you've not told us about or you'll need to handle these above the httpd (e.g. with a fail2ban rule, syn rate limiting in iptables). You probably want to get in touch with the poeple running thumbnails.com too.

share|improve this answer
    
You're probably right. I thought this caused the system overload... Drawn the wrong conclusion. I'll check other logs to see if I can find a cause. Thanks for your answer. –  user1343955 Apr 19 '12 at 13:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.