Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So today I was surprised to find this in my error.log. The domain was registered a few weeks back, and its private. No one but knows me. I put an authtype login.

[Sun Oct 25 17:37:38 2009] [crit] [client 88.191.76.63] configuration error:  couldn't perform authentication. AuthType not set!:
/phpmyadmin/scripts/setup.php
[Sun Oct 25 18:57:47 2009] [error] [client 96.9.152.120] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23):
/w00tw00t.at.ISC.SANS.DFind:)
share|improve this question

migrated from stackoverflow.com Oct 27 '09 at 0:26

This question came from our site for professional and enthusiast programmers.

1  
Welcome to Server Fault (and Stack Overflow)! You can merge your SO and SF accounts using the "accounts" tab on your user page, so that you can "own" this post as well. Then you'll be able to comment on answers here because it will be your post. –  Greg Hewgill Oct 27 '09 at 0:51
add comment

2 Answers 2

the /w00tw00t.at.ISC.SANS.DFind: is a very common request signature from the "Dfind" vulnerability scanner. The Dfind scanner appears to be something that gets installed on people's Windows boxes as malware or trojans, but it can be downloaded legitimately from a few sources (just Google it).

It's basically checking for holes in your security, so not quite a hack ATTEMPT, but it's the equivalent of someone casing the joint. That said, this is super common and relatively harmless as long as you have secured the rest of your site. You can block these requests easily using any combination of URL Rewriting, ACLs, Apache Directives, etc.

Any server you have running on PORT 80 on a public IP is likely to see this at some point.

If you are using phpmyadmin, you should probably secure it by using ACLs or some equivalent to prevent access from any IP not owned by you, change the directory alias so that it's a bit more obtuse, and/or only turn it on when you are needing to use it.

As a side-note, you can use MySQL's own MySQLAdministrator and MySQLQueryBrowser which do more and have a better interface, and in order to allow remote access to the server without exposing it to the world, setup a secure SSH tunnel. I wrote about how to do it on a blog if you are interested.

HTH

share|improve this answer
add comment

Any server on the Internet will receive login attempts like this. The second error, the fact that a request was sent without a hostname, is a clue that the (presumed) attacker does not know your domain name at all, and is just trying as many IP addresses as possible.

Do you actually have "phpmyadmin" set up, or is that just a random request sent by somebody looking for a soft target?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.