2

My server has recently been suffering temporary floods of probing HTTP requests looking for PHPMyAdmin. They come from various IPs and come in series. That is, for a few seconds I'm getting a bunch of requests from the same IP for a range of URLs. The intensity surges up to 10 requests per second. Here's an example of a list of URLs:

/mysql/web/
/mysql/pMA/
/sql/phpmanager/
/sql/php-myadmin/
/sql/phpmy-admin/
/sql/sql/
/sql/myadmin/
/sql/webadmin/
/sql/sqlweb/
/sql/websql/
/sql/webdb/
/sql/sqladmin/
/sql/sql-admin/
/sql/phpmyadmin2/
/sql/phpMyAdmin2/
/sql/phpMyAdmin/
/db/myadmin/
/db/webadmin/
/db/dbweb/
/db/websql/
/db/webdb/
/db/dbadmin/
/db/db-admin/
/db/phpmyadmin3/
/db/phpMyAdmin3/
/db/phpMyAdmin-3/
/administrator/phpmyadmin/
/administrator/phpMyAdmin/
/administrator/db/
/administrator/web/
/administrator/pma/
/administrator/PMA/
/administrator/admin/
/phpMyAdmin2/
/phpMyAdmin3/
/phpMyAdmin4/
/phpMyAdmin-3/
/php-my-admin/
/PMA2011/
/PMA2012/
/PMA2013/
/PMA2014/
/PMA2015/
/PMA2016/
/PMA2017/
/PMA2018/
/pma2011/
/pma2012/
/pma2013/
/pma2014/
/pma2015/
/pma2016/
/pma2017/
/pma2018/
/phpmyadmin2011/
/phpmyadmin2012/
/phpmyadmin2013/
/phpmyadmin2014/
/phpmyadmin2015/
/phpmyadmin2016/
/phpmyadmin2017/
/phpmyadmin2018/
/phpmanager/

This list may vary from IP to IP. The question is how to effectively choke this kind of attack down to, say, 1 request per second. And if possible, block the IP for 1 minute after 3 invalid URLs. I don't use PHPMyAdmin, nor do I have any other HTTP-based database interfaces. But I would prefer to keep this gate open or easily openable in the future.

As for a solution, I've been thinking of blocking requests at the level of Apache 2, which seems too late, maybe wrongly. Or down below Apache, at the level of Netfilter. I'm using UFW and would like to stay with it and not to manipulate IPTables directly. UFW then would need to know somehow which requests are ok or not. So a bridge to Apache is needed, I gather?

In general, this question is open for any answers addressing the problem of sniffing HTTP requests in the context of Linux+Apache.

  • 1
    On a very generic level, you might be looking for fail2ban or similar, which can scan logfiles (e.g. httpd.log) and issue (and later undo) firewall commands. – Ulrich Schwarz Jul 2 '17 at 9:55
  • Hey , have you found anything on this. I've had the same kind of attack taking my server down. – RED Sep 5 '17 at 10:07
  • @RED. I tried fail2ban and it seemed like working. I had some configuration issue, but the tool seemed correct. I've taken my server down in the meantime, so not really interested anymore. – Tomasz Sep 5 '17 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.