0

I was going through apache log, and I thought some of the access logs seemed suspicious... I'm not pro, just do server administration as hobby :) so I wonder if I should take some steps...

86.138.17.122 - - [20/May/2012:12:53:14 +0200] "\xcb\xaap\xdc\xf9\xba\xec\x0e\x11\xfa\x1d%\x1f\xe9L$\xff\xa6\xe8-\xd2\x11" 501 309 "-" "-" 218.246.22.178 - - [20/May/2012:14:49:22 +0200] "GET /phpMyAdmin/translators.html HTTP/1.1" 404 544 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]" 31.176.134.118 - - [21/May/2012:10:32:31 +0200] "\xbe" 501 288 "-" "-" 92.80.76.244 - - [20/May/2012:13:28:19 +0200] "-" 408 0 "-" "-"

I'm not sure about the last one, but first three definitely looks like someone is probing for non existent software on my server.

sudo grep -ir "218.246.22.178" /var/log/apache2/*

/var/log/apache2/access.log:218.246.22.178 - - [20/May/2012:14:49:22 +0200] "GET /phpMyAdmin/translators.html HTTP/1.1" 404 544 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]" /var/log/apache2/access.log.1:218.246.22.178 - - [19/May/2012:23:01:55 +0200] "GET /translators.html HTTP/1.1" 404 533 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]" /var/log/apache2/access.log.1:218.246.22.178 - - [20/May/2012:06:30:03 +0200] "GET /phpmyadmin/translators.html HTTP/1.1" 404 544 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]" /var/log/apache2/error.log:[Sun May 20 14:49:22 2012] [error] [client 218.246.22.178] File does not exist: /var/www/phpMyAdmin /var/log/apache2/error.log.1:[Sat May 19 23:01:55 2012] [error] [client 218.246.22.178] File does not exist: /var/www/translators.html /var/log/apache2/error.log.1:[Sun May 20 06:30:03 2012] [error] [client 218.246.22.178] File does not exist: /var/www/phpmyadmin /var/log/apache2/other_vhosts_access.log::443 218.246.22.178 - - [20/May/2012:14:49:19 +0200] "GET /phpMyAdmin/translators.html HTTP/1.1" 401 3233 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]" /var/log/apache2/other_vhosts_access.log.1::443 218.246.22.178 - - [20/May/2012:06:30:02 +0200] "GET /phpmyadmin/translators.html HTTP/1.1" 401 3232 "-" "Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]"
Improve this question

3 Answers 3

Reset to default
1

This is pretty common behavior with any web server exposed to the internet. Hackers are scanning for vulnerabilities and open proxies. Check out fail2ban to block them and logwatch to monitor for anything out of the ordinary.

Improve this answer
0

it's vulnerability scanners in search for outdated/exploitable software, most probably scanning large range of addresses. if you keep your stack up-to-date - probably you don't need to worry.

you can try scanning your own site eg using nikto2 just to see what sort of requests are sent and possibly find how to secure better your setup.

it's arguable if it's just security-through-obscurity or good practice but you can also configure your default vhost [most scans will call your server by ip address rather than domain name] not to serve any content and respond just with errors or static page.

Improve this answer
0

These are the vulnerability scanner bots often run by research organizations and even attackers. Unless these scans hit and return a HTTP 200 response code, you shouldn't really worry about it.

Some popular scans will leave the following footprint on your server

 /w00tw00t.at.ISC.SANS.test0:): 1 Time(s)

It's is always recommended to use a firewall on any Internet facing server. You can configure iptables manually or even install csf (ConfigServer Firewall) which is a free and open source firewall and can defend you against various common attacks.

Improve this answer

You must log in to answer this question.