Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I own a server that it's costantly being attacked by scripts (that try to access to phpMyAdmin's setup file's and stuff like this). I've heard that many people get this kinds of attacks, but I'm starting to worry since they are getting more common (last month I got 2 attacks, and on november 7th there are 3 attempts already (1st, 4th and 6th of nov).

I'm not really concerned about it, since I don't have any database. All the info i have on that server is absolutely public, but I'm worried about that attacking-rate increase.

So I thought I could -temporarily- block the IPs that come from those attackers, or something that could make my server ignore requests that ask for phpMyAdmin, pma, xamp, etc.

Is there something like that? my server is Linux+Apache+Php

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

There's a program called fail2ban which is designed to watch a log file for text matching a regexp - usually signatures of a failed login, or script attack - and block the requesting IP for a configurable period of time via iptables rules.

Given that their main page explicitly mentions watching an apache logfile, then provided you can say exactly what the log signature of one of these "attacks" looks like, I suspect this might be just the sort of thing you're looking for.

share|improve this answer
    
Exactly, I was looking for something like that, and I think this will work. Thank you very much –  Victor Oliva Nov 7 '12 at 10:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.