Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

The following requests (this is about half of them) in my Nginx access log have all come over the span of a few minutes from an IP that is registered to an ISP in Vietnam (I could provide the IP, but I'm not sure if that's allowed her). I just set up the server yesterday. Note the libwww-perl/5.805 user agent, and the paths (looking for common config files, etc.).

Should I be concerned by this, or are there just so many bots scanning IPs that it's inevitable to get scans like this every day?

<some IP in Vietnam> - - [22/May/2013:11:15:44 +0000] "GET /db_config.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:45 +0000] "GET /db_conf.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:45 +0000] "GET /data.inc HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:46 +0000] "GET /dados.inc HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:46 +0000] "GET /conecta.inc HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:47 +0000] "GET /database.inc HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:47 +0000] "GET /banco.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:48 +0000] "GET /mysql.inc HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:48 +0000] "GET /dbsql.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:49 +0000] "GET /sqldb.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:49 +0000] "GET /backup.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:50 +0000] "GET /DB.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:50 +0000] "GET /include/config.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:51 +0000] "GET /include/dbconfig.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:51 +0000] "GET /include/conf.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:52 +0000] "GET /include/connect.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:52 +0000] "GET /include/db.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:53 +0000] "GET /include/conexao.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:53 +0000] "GET /include/configuration.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:54 +0000] "GET /include/application.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:54 +0000] "GET /inc/config.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:55 +0000] "GET /inc/dbconfig.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:55 +0000] "GET /inc/conf.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:56 +0000] "GET /inc/connect.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:56 +0000] "GET /inc/db.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:57 +0000] "GET /inc/conexao.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:57 +0000] "GET /inc/configuration.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:58 +0000] "GET /inc/application.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:58 +0000] "GET /includes/config.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:59 +0000] "GET /includes/dbconfig.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:15:59 +0000] "GET /includes/conf.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:00 +0000] "GET /includes/connect.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:00 +0000] "GET /includes/db.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:01 +0000] "GET /includes/conexao.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:01 +0000] "GET /includes/configuration.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:02 +0000] "GET /includes/application.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:02 +0000] "GET /application/configs/application.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:03 +0000] "GET /application/configs/config.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:03 +0000] "GET /application/configs/dbconfig.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:04 +0000] "GET /application/configs/db.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:04 +0000] "GET /application/configs/connect.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:05 +0000] "GET /application/configs/conexao.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:05 +0000] "GET /application/configs/conf.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:06 +0000] "GET /application/configs/configuration.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:06 +0000] "GET /application/configs/data.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:07 +0000] "GET /application/configs/banco.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:07 +0000] "GET /application/configs/dbconf.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:08 +0000] "GET /configs/application.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:09 +0000] "GET /configs/config.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:09 +0000] "GET /configs/dbconfig.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:10 +0000] "GET /configs/db.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:10 +0000] "GET /configs/connect.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:11 +0000] "GET /configs/conexao.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:11 +0000] "GET /configs/conf.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:12 +0000] "GET /configs/configuration.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:12 +0000] "GET /configs/data.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:13 +0000] "GET /configs/banco.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
<some IP in Vietnam> - - [22/May/2013:11:16:13 +0000] "GET /configs/dbconf.ini HTTP/1.1" 502 166 "-" "libwww-perl/5.805"
share|improve this question
1  
You should also find other tries in /var/log/auth.log and /var/log/mail.log. –  ott-- May 22 '13 at 15:24
    
Thanks. I guess I should look for pam_unix(sshd:session): session opened for user root –  orokusaki May 22 '13 at 16:10

2 Answers 2

up vote 3 down vote accepted

You will get scans like this for any IP that's exposed to the internet. It's part of the normal background noise you should expect to see.

A variety of tools can be used to rate limit or ban IPs performing scans like this - mod_security, iptables, fail2ban, etc. - but it's generally not necessary.

share|improve this answer
    
Unless of course they are running vulnerable software, although in that case they have other things to worry about. –  Nathan C May 22 '13 at 14:58
    
Awesome, thanks! I didn't realize that basic iptables was "stateful". How can I use iptables to rate limit (including bursting, etc.)? –  orokusaki May 22 '13 at 15:04
2  
That would be a different question. A little research on "iptables rate limiting" should get you started. –  Nathan C May 22 '13 at 15:04

Your assumption is correct: the number of compromised hosts spending their time (and owners' bandwidth allocations) probing for vulnerabilities probably runs into the millions. As you can see from the timestamps, the attack is automated.

It can be instructive to read these attacks as it gives you an idea as to what vulnerabilities are being probed, but in general they just serve as a reminder to keep your system patched and secure.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.