1

since some days, i am getting some tries of hack attacks, but actually all seems fine.

but i saw some log i could not explain:

127.0.0.1:443 216.218.206.66 - - [09/Oct/2015:04:49:29 +0200] "GET / HTTP/1.1" 404 4857 "-" "-"
127.0.0.1:80 220.181.108.177 - - [09/Oct/2015:07:56:11 +0200] "-" 408 0 "-" "-"
127.0.0.1:443 199.115.117.88 - - [09/Oct/2015:10:35:04 +0200] "GET /admin/i18n/readme.txt HTTP/1.1" 404 5081 "-" "python-requests/2.8.0"

here is my log configuration:

# - Exeption
SetEnvIf Request_URI "\.jpg$|\.jpeg$|\.gif$|\.png$|\.ico|\.icon|\.css$|\.js$|piwik\.php$|frogglogin\.php" dontlog
SetEnvIf User-agent "(bot|baidu)" dontlog

CustomLog ${APACHE_LOG_DIR}/access.log vhost_combined env=!dontlog
  • how is it possible to thoose requests to reach 127.0.0.1 ?
  • what can i do to prevent 408 errors ?
  • should i panic to see thoose kind of attaks incomming ?

thanks

PS:

is this a good idea ?

<VirtualHost 127.0.0.1>
# [ Default restriction ]
<Directory />
    Order deny,allow
    Deny from all
    allow from 127.0.0.1
</Directory>
</VirtualHost>
Improve this question

2 Answers 2

Reset to default
1

There is no way that the public IP address will reach directly to your loopback address. It is the matter of NAT where probably apache translates those IP addresses to loopback because either you told apache to do that or some misconfiguration.

There is no panic for such thing, it is normal to be attacked by botnets and/or automated apps designed to attempt login pages and so on.

When this attemps are in progress I'd rather check with:

  netstat -an (or adding additional parameters)

To check the connections.

Improve this answer
3
  • thank for the answer, i am behind a nat, but if i allowed loopback it is a mistake, how could it be done in apache ? i added a config is that a good idea ?
    – Froggiz
    Oct 9, 2015 at 12:19
  • I don't think that is a good idea at all. I don't see any need of such configuration. Pls check netstat as I suggested and you'll see the public interfaces and check your network configuration.
    – ostendali
    Oct 9, 2015 at 13:35
  • i am sorry i need more time for testing, i will give information when i ll be on it !
    – Froggiz
    Nov 3, 2015 at 10:24
0

This is how i get ride of this :

I added this configuration after all defined virtual host, to catch "else" request (the request that doesn't match any other virtual host). The most important is the virtual position(last) and the command ServerAlias *

#---------------#
# [ LOCALHOST ] #
#---------------#
# Local host for other:
# ServerName localhost
# ServerName 88.xxx.xxx.xxx
# ServerName xxxxxxxx.net
# and more ...
# need to be at the last position
<VirtualHost *:80 *:443>
# [ Server Domain ]
ServerName localhost
ServerAlias *
# [ Server Root ]
DocumentRoot /var/www/home/
# [ Cancel trafic ]
RewriteCond %{REQUEST_URI} !errors\/hack\.htm
RewriteRule .*? - [END,R=406]
# [ Custom Log ]
CustomLog ${APACHE_LOG_DIR}/hack.log combined
</VirtualHost>
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .