0

Apparently someone ist probing my AWS Server and causing a Environment health has transitioned from Degraded to Severe. 100.0 % of the requests are erroring with HTTP 4xx

I have included the error logs, as you can see the IP tests for all sorts of possible php scripts. What can I do to ban the IP the requests are coming from? I have heard of fail2ban, but I am not sure if it can be used in this situation? Has anyone ever experienced this?

[Mon Jun 17 05:39:05.846381 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/ysy.php' not found or unable to stat
[Mon Jun 17 05:39:07.067165 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/3.php' not found or unable to stat
[Mon Jun 17 05:39:07.275508 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/zxc.php' not found or unable to stat
[Mon Jun 17 05:39:07.478261 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/Hzllaga.php' not found or unable to stat
[Mon Jun 17 05:39:08.067036 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/inc.php' not found or unable to stat
[Mon Jun 17 05:39:08.523427 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/webconfig.php' not found or unable to stat
[Mon Jun 17 05:39:09.658591 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/code.php' not found or unable to stat
[Mon Jun 17 05:39:09.871922 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/temtel.php' not found or unable to stat
[Mon Jun 17 05:39:10.770021 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/data.php' not found or unable to stat
[Mon Jun 17 05:39:10.990729 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/fuck.php' not found or unable to stat
[Mon Jun 17 05:39:11.203321 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/.config.php' not found or unable to stat
[Mon Jun 17 05:39:11.409662 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/test.php' not found or unable to stat
[Mon Jun 17 05:39:11.618755 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/cron.php' not found or unable to stat
[Mon Jun 17 05:39:11.831007 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/v.php' not found or unable to stat
[Mon Jun 17 05:39:13.638680 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/zxc1.php' not found or unable to stat
[Mon Jun 17 05:39:13.855491 2019] [php7:error] [pid 26537] [client 172.31.43.195:8084] script '/var/www/html/zxc0.php' not found or unable to stat
[Mon Jun 17 05:39:15.363952 2019] [php7:error] [pid 26786] [client 172.31.43.195:8118] script '/var/www/html/zxc1.php' not found or unable to stat
[Mon Jun 17 05:39:15.569311 2019] [php7:error] [pid 26786] [client 172.31.43.195:8118] script '/var/www/html/zxc2.php' not found or unable to stat
[Mon Jun 17 05:39:15.778830 2019] [php7:error] [pid 26786] [client 172.31.43.195:8118] script '/var/www/html/indexa.php' not found or unable to stat```
Improve this question
4
  • 1
    Two remarks: - Since the ip-address 172.31.43.195 is from a RFC 1918 private range, that is probably the IP-address of a reverse proxy, load balancer or similar component in your own infrastructure. That is probably not the ip-address you should block. If you want to use fail2ban or similar you need extract, record and block the actual client ip-address.
    – HBruijn
    Jun 17, 2019 at 10:53
  • 1
    - You can configure advanced health rules in Elastic Beanstalk where you instruct elastic beanstalk to ignore 4xx errors as indicative of bad health.
    – HBruijn
    Jun 17, 2019 at 10:53
  • @HBruijn I have already changed the advanced health rules accordingly. Given the number of requests is quite low - should I even do anything about this?
    – mo_st
    Jun 17, 2019 at 11:54
  • 2
    That is background internet noise, servers and online services get continuously probed for possible susceptibility to known exploits. And thus (as long as you're not vulnerable) nothing to lose any sleep over
    – HBruijn
    Jun 17, 2019 at 14:23

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .