-1

I have been seeing a lot of these entries in my logs lately:

GET /phpmyadmin/ 404 7ms
GET /phpMyAdmin/ 404 6ms
GET /PMA/ 404 5ms
GET /pma/ 404 3ms
GET /admin/ 302 6ms - 59b
GET /dbadmin/ 404 4ms
GET /sql/ 404 25ms
GET /mysql/ 404 38ms
GET /phpmyadmin2/ 404 5ms

Is there something I can do in nginx config to make these people:

  • go away
  • suffer
Improve this question

1 Answer 1

Reset to default
3

You could use fail2ban, and have it consume the nginx access log, and make rules for these queries.

If you aren't using the services this rotorooter is targetting, you don't really need to do anything. They will get 404 and you will not be pwned.

Improve this answer
2
  • that sounds almost as fun as setting up a fake phpmyadmin and seeing what they insert into where ;)
    – mkoryak
    Oct 19, 2013 at 3:22
  • You can totally make a honeypot, yes... it's better to avoid doing that on a server not built specifically for the purpose and firewalled off in a DMZ away from everything else.
    – Falcon Momot
    Oct 19, 2013 at 3:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .