5

I have a Linux web server running Rails and each time I check the Nginx logs I find attempts to access PHPMyAdmin, database and admin directories such as this:

190.196.161.110 - - [16/Oct/2011:23:37:31 +0100] "GET //PHPMyAdmin/ HTTP/1.1" 404 728 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"

The attacks are coming from a variety of different IP addresses and they just increment version numbers and check each directory, e.g. GET //PHPMyAdmin 1.0/, GET //PHPMyAdmin 1.1/ etc.

Will this affect the performance of my web server much? Also, is there a way to automatically ban IP addresses that do such things e.g. like fail2ban for ssh log-in attempts.?

rsl
  • 53
  • 1
  • 3

2 Answers2

10

If you're using Apache for such applications, you may want to look into ModSecurity, mod_evasive and/or mod_qos. The latter two are more geared towards brute force and DoS attacks. ModSecurity though has a ton of stuff under its banner.

Krzysztof Kotowicz
  • 4,068
  • 20
  • 30
Ryan Draga
  • 116
  • 1
  • 2
3

Fail2ban has an example script for doing this from Apache log files. Basically look for the PHPMyAdmin string in your logs with a 404.

Jeff Ferland
  • 38,090
  • 9
  • 93
  • 171