3

I have just seen a new series of error in the /var/log/apache2/error.log

[Thu May 07 17:12:35.433760 2015] [:error] [pid 3488] [client 190.79.132.215:51660] script '/var/www/html/r.php' not found or unable to stat
[Thu May 07 17:12:38.066293 2015] [:error] [pid 3471] [client 190.79.132.215:51679] script '/var/www/html/r.php' not found or unable to stat
[Thu May 07 17:12:43.523091 2015] [:error] [pid 3474] [client 190.204.156.103:59542] script '/var/www/html/r.php' not found or unable to stat
[Thu May 07 17:12:45.213665 2015] [:error] [pid 3451] [client 190.204.156.103:59568] script '/var/www/html/r.php' not found or unable to stat
[Thu May 07 17:12:50.660274 2015] [:error] [pid 3472] [client 190.204.156.103:59592] script '/var/www/html/r.php' not found or unable to stat
[Thu May 07 17:12:51.354739 2015] [:error] [pid 3473] [client 82.8.22.23:49205] script '/var/www/html/r.php' not found or unable to stat
[Thu May 07 17:12:51.512948 2015] [:error] [pid 3446] [client 82.8.22.23:49206] script '/var/www/html/r.php' not found or unable to stat
[Thu May 07 17:12:51.669047 2015] [:error] [pid 3488] [client 82.8.22.23:49207] script '/var/www/html/r.php' not found or unable to stat
[Thu May 07 17:12:51.838961 2015] [:error] [pid 3471] [client 82.8.22.23:49208] script '/var/www/html/r.php' not found or unable to stat

r.php doesn't exist.

This server is running Ubuntu 14.04 in a LAMP setup.

I have never seen this sort of attack before, should i be concerned or securing my system in any way for them?

3

Looks like someone is scanning your website on different ports and looking for a specific file (r.php) which could be a backdoor or something similar. As the file does not exist it throws errors (which is good)... I see this kind of log entries from time to time as well.

Stick to these answers on how to secure LAMP in general: Tips for Securing a LAMP Server

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.