0

I am recieving a lot of suspicious requests which cause Apache to use a lot of memory (over 1GB)

[Mon Feb 24 09:48:29 2014] [error] [client 120.37.238.125] PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted (tried to allocate 76 bytes) in /var/www/wiki/lib/plugins/authplain/auth.php on line 321, referer: http://myserver.com/wiki/clash_of_clans_cheat?do=register

[Mon Feb 24 09:51:01 2014] [error] [client 23.94.23.159] (36)File name too long: access to /wiki/viagra-bestellen_2013_profile_kerstinsheean_how_to_get_no_credit_check_financial_loans_up_to_5000_profile_dawnmillington_profile_gidgetmcwhorter_how_much_ict_is_electronic_healthcare_record_emr_solutions_profile_constancesylves_profile_constancesylves_paying_for_healthcare_equipment_and_treatment failed

This 2 messages keep on repeating from various IPs (~10 msg per minute). How can I protect from this? I have already setup fail2ban which bans over 40 IPs every 5 minutes...

I am using Ubuntu 12.04.2 LTS server with Apache 2.2 + PHP5.3. There is just one Dokuwiki on the server which is private and almost unused.

1

Looking at the two different IP addresses you posted (one from China and the other from the U.S.), I'm going to guess that these are infected botnet machines running scripted attacks.

If the Docuwiki is private enough that you can block it off to only respond to certain IP ranges, that would probably be your best bet. Otherwise...

I don't know what version of Docuwiki you're running, but it looks like recent versions support a Bad Behavior plugin. I've had good luck with Bad Behavior in the past. (Bad Behavior rejects requests from malformed clients, like scripts.) You might want to consider something like that as well.

-2

Your Wiki -software seems a bit broken, by looking at the first log entry. It exhausts server memory.

You should update your Wiki-software. Hope the new version has fixed the memory exhaustion problem it has.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.