I have made a website in Django 1.6 with PostgreSQL database which is hosted on Ubuntu 12.04.3 with Apache 2.2.22 and I have recently noticed lots of hacking (probing) attempts from various IPs constantly every day which fills my inbox with reports which starts to being just annoying.
Some excerpts from server requests (paths and IPs are masked):
'PATH_INFO': u'/myadmin/scripts/setup.php', 'PATH_TRANSLATED': '/path/to/my/project/project.wsgi/myadmin/scripts/setup.php', 'QUERY_STRING': '', 'REMOTE_ADDR': 'XXX.XXX.XXX.XXX', 'REMOTE_PORT': '62637', 'REQUEST_METHOD': 'GET', 'REQUEST_URI': '/myadmin/scripts/setup.php', 'PATH_INFO': u'/phpTest/zologize/axa.php', 'PATH_TRANSLATED': '/path/to/my/project/project.wsgi/phpTest/zologize/axa.php', 'QUERY_STRING': '', 'REMOTE_ADDR': 'XXX.XXX.XXX.XXX', 'REMOTE_PORT': '60853', 'REQUEST_METHOD': 'GET', 'REQUEST_URI': '/phpTest/zologize/axa.php', 'PATH_INFO': u'/pma/scripts/setup.php', 'PATH_TRANSLATED': '/path/to/my/project/project.wsgi/pma/scripts/setup.php', 'QUERY_STRING': '', 'REMOTE_ADDR': 'XXX.XXX.XXX.XXX', 'REMOTE_PORT': '64751', 'REQUEST_METHOD': 'GET', 'REQUEST_URI': '/pma/scripts/setup.php', 'CSRF_COOKIE': u'bmbTHkbfWOeldHyAWBwj6rLb2yEopMnZ', 'PATH_TRANSLATED': '/path/to/my/project/project.wsgi/HNAP1/', 'QUERY_STRING': '', 'REMOTE_ADDR': 'XXX.XXX.XXX.XXX', 'REMOTE_PORT': '57303', 'REQUEST_METHOD': 'GET', 'REQUEST_URI': '/HNAP1/',
In some way, I am not concerned with those attempts since they are mostly checking for php vulnerabilities (as far as I have noticed), but I'd like to do something about it more than only fail2ban those IPs.
Since this is the first time I am struggling with this, I'd like to be sure that my web server is really secured enough and I wonder what could I do to be sure that those bots won't do any harm to my web site and database. The information in db itself is not so extra-important and even if someone get a copy of it no one will be hurt, but still... :)
So, my questions are:
1) Is my website and database really "safe" so far since I am not serving any PHP sites on it?
2) Is there anything I can do with Python/Django to gather more info about this attempt except the IP/PORT and PATH they were requesting (e.g. to get the source of the actual script which a "person" tried to run)?
3) Is there any list of very well known IPs which are used for scanning such vulnerabilities so I can automatically update my banned IPs list?
4) Is there any service where I could report IPs which I collected?
5) What are the best practices in general to make your website/server safe from not only those scripts, but any other common penetration attempts (I am aware there may be tons of various attempts, but I'm curious about my specific server configuration only - Django/PostgreSQL/Apache/Ubuntu)?
Thank you very much for any help and tips regarding this!