0

This question already has an answer here:

I host three different websites on the same server. Here's excerpts from this morning's Apache logs:

### SITE 1 ###
[Fri Dec 13 09:15:49 2013] [error] [client 85.17.87.36] script not found or unable to stat: /var/www/vhosts/site1.com/cgi-bin/php.cgi
[Fri Dec 13 09:15:49 2013] [error] [client 85.17.87.36] script not found or unable to stat: /var/www/vhosts/site1.com/cgi-bin/php4
[Fri Dec 13 09:23:21 2013] [error] [client 113.53.238.155] script not found or unable to stat: /var/www/vhosts/site1.com/cgi-bin/php
[Fri Dec 13 09:23:22 2013] [error] [client 113.53.238.155] script not found or unable to stat: /var/www/vhosts/site1.com/cgi-bin/php5
[Fri Dec 13 09:23:22 2013] [error] [client 113.53.238.155] script not found or unable to stat: /var/www/vhosts/site1.com/cgi-bin/php-cgi
[Fri Dec 13 09:23:23 2013] [error] [client 113.53.238.155] script not found or unable to stat: /var/www/vhosts/site1.com/cgi-bin/php.cgi
[Fri Dec 13 09:23:24 2013] [error] [client 113.53.238.155] script not found or unable to stat: /var/www/vhosts/site1.com/cgi-bin/php4
[Fri Dec 13 09:47:03 2013] [error] [client 172.246.127.26] File does not exist: /var/www/vhosts/site1.com/httpdocs/install
[Fri Dec 13 09:47:08 2013] [error] [client 172.246.127.26] File does not exist: /var/www/vhosts/site1.com/httpdocs/phpbb3

### SITE 2 ###
[Fri Dec 13 09:24:39 2013] [error] [client 107.20.169.255] script not found or unable to stat: /var/www/vhosts/site2.com/cgi-bin/php
[Fri Dec 13 09:24:39 2013] [error] [client 107.20.169.255] script not found or unable to stat: /var/www/vhosts/site2.com/cgi-bin/php5
[Fri Dec 13 09:24:39 2013] [error] [client 107.20.169.255] script not found or unable to stat: /var/www/vhosts/site2.com/cgi-bin/php-cgi
[Fri Dec 13 09:24:39 2013] [error] [client 107.20.169.255] script not found or unable to stat: /var/www/vhosts/site2.com/cgi-bin/php.cgi
[Fri Dec 13 09:24:40 2013] [error] [client 107.20.169.255] script not found or unable to stat: /var/www/vhosts/site2.com/cgi-bin/php4

### SITE 3 ###
[Fri Dec 13 09:24:40 2013] [error] [client 107.20.169.255] script not found or unable to stat: /var/www/vhosts/site3.com/cgi-bin/php
[Fri Dec 13 09:24:40 2013] [error] [client 107.20.169.255] script not found or unable to stat: /var/www/vhosts/site3.com/cgi-bin/php5
[Fri Dec 13 09:24:40 2013] [error] [client 107.20.169.255] script not found or unable to stat: /var/www/vhosts/site3.com/cgi-bin/php-cgi
[Fri Dec 13 09:24:40 2013] [error] [client 107.20.169.255] script not found or unable to stat: /var/www/vhosts/site3.com/cgi-bin/php.cgi
[Fri Dec 13 09:24:40 2013] [error] [client 107.20.169.255] script not found or unable to stat: /var/www/vhosts/site3.com/cgi-bin/php4

As you can see, some attackers are probing for the existence of software that might be installed on the server, perhaps to search for exploits. I see things like this all the time. One concern is that these logs don't indicate when they were successful. And, in one case, the same IP address is even probing two different sites at the same time. This time the requests seem to be coming from clouds, but that is not always the case.

When the IP address is from places like China or Russia, I manually deny the entire range and restart Apache. But when IP addresses are in the USA, I can't deny the entire range because they could theoretically be used by legitimate customers.

I don't know if this is possible, but I'd like to dynamically block an IP address when certain URL paths are requested.

For example, an IP address would automatically be denied if it requested /cgi-bin/php-cgi

The deny could be temporary in nature. Apache would automatically handle this without requiring a restart.

Is anything like this possible?

marked as duplicate by Michael Hampton Dec 13 '13 at 17:17

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1

A fairly simple solution is to have fail2ban monitor your logs and add the IPs to your firewall.

  • Thanks. I've never heard of fail2ban before. I'll look into it. – Timothy B. Dec 13 '13 at 17:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.