Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two directories, under /var/www/vhosts: mydomain/ and default/. Files in default directory can be accessed using IP address of our server.

I have checked Apache log and somebody is constantly, trying to access random files under that directory - is performing "mapping". Also IP address, from which request is coming appears always different in Apache's error log. I have also a suspicion that this mapping causes Apache to run out of available slots, and jam at the end.

Here is a snippet from Apache log:

[Mon May 14 16:04:04 2012] [error] [client 190.12.83.230] File does not exist: /var/www/vhosts/default/htdocs/manager
[Mon May 14 16:05:29 2012] [error] [client 200.48.7.17] File does not exist: /var/www/vhosts/default/htdocs/manager
[Mon May 14 16:19:12 2012] [error] server reached MaxClients setting, consider raising the MaxClients setting

Is there any way to prevent these attacks?

share|improve this question
add comment

2 Answers

Why do you think that these scans cause apache to run out of available slots?

I suggest that instead of hunting a phantom, you first configure mod_status to find out what URLs are being processed by your server. You can then decide what action you want to take.

share|improve this answer
add comment

You can install and configure fail2ban to block access for ips that generates those kind of errors.

here are some helpful links

http://www.the-art-of-web.com/system/fail2ban/

http://richardjh.org/blog/blocking-brute-force-attacks-to-dovecot-on-centos/

http://www.fail2ban.org/wiki/index.php/MANUAL_0_8

share|improve this answer
2  
Thank you for linking to my site but you have linked to a dynamic link on richardjh.org used for paging results. The contant on that page will change as posts are added. Perhaps You meant to use richardjh.org/blog/…. I have edited you answer to use this URL I hope that is ok. –  Richard Holloway May 15 '12 at 21:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.