1

Recently we are having a lot of hits to wordpress xmlrpc.php which in end causes high load on the servers.

We tried rewriting all xmlrpc.php to 127.0.0.1 but didn't help much. Since apache was still handling the connections. In the end we blocked this kind of connections using

iptables -I INPUT 1 -p tcp --dport 80 -m string --string "xmlrpc.php" --algo bm -j DROP

Unfortunately, all of this is causing problems with plugins that are using xmlrpc.php like jetpack etc.

Anyone had experience with this kind of problem and has some suggestions how to handle this ?

Edit: Is it possible to add additional rule which would allow access from the wordpress IP range ? How would that rule look like since the blocking rule is using string ?

3

The firewall rule you described has 2 issues:

  1. You should make some rate-limits for it rather than just blocking everything.

  2. Using the string module in the firewall is not very wise due to performance reasons.

Your best choice is to put HAProxy in front of Apache. You can take a look at my answer in this post for more details on how to do it and why.

2

My personal experience in this type of thing is to avoid "patching" the issue. Don't block one bot hitting one link. Other bots will just come in and hit other links. You need to setup some sort of brute force/dos protection that will block repetitive hits against your server.

ModSecurity is great for this and is an apache built in if you are using apache as your web server.

If you are not you mentioned wordpress. Wordpress has multiple plugins for blocking this sort of repetitive activity. WordFence is a good one that we have had success with our clients in using.

Overall I recommend you fix the root cause and not just try to fix the singular instance.

  • While mod_security is very good for this kind of things, Apache will still spawn new processes in order to be able to pass the request to mod_security so much of the performance impact of the DDOS will still be there. As such, I truly believe that an evented highly powered filtering engine is the appropriate solution, just as I mentioned in my answer. – Florin Asăvoaie Jan 1 '16 at 14:13
1

My Suggestion is about the issue please try to block access by adding this code in

.htaccess
<Files "xmlrpc.php">
Order Deny,Allow
Deny from all
</Files>
  • I disagree with this comparing to the solution I mentioned because if you use mod_prefork like most of the Apache installations, the botnet will still cause a lot of issues due to Apache spawning a large number of processes. Also, if the iptables rule caused functional issues with WordPress, what makes you think that this rewrite rule will not? – Florin Asăvoaie Jan 1 '16 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.