亂槍打鳥?

這幾天cciilin跟我說,伺服器怪怪的,有時候httpd會癱掉
去檢查了一下log發現還真是莫名其妙,原來是被機器人狂掃

[Fri Oct 01 18:21:06 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/myadmin
[Fri Oct 01 18:21:06 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:06 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/
mysql-admin
[Fri Oct 01 18:21:06 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:06 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/mysql
[Fri Oct 01 18:21:06 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:07 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/
mysqladminconfig
[Fri Oct 01 18:21:07 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:07 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/
mysqlmanager
[Fri Oct 01 18:21:07 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:08 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/p
[Fri Oct 01 18:21:08 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:08 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/pMA
[Fri Oct 01 18:21:08 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:09 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/
php-my-admin
[Fri Oct 01 18:21:09 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:09 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/
php-myadmin
[Fri Oct 01 18:21:09 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:10 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.2.3

[Fri Oct 01 18:21:10 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:10 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.2.6
[Fri Oct 01 18:21:10 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:10 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.1
[Fri Oct 01 18:21:10 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:11 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.4
[Fri Oct 01 18:21:11 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:11 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.5-pl1
[Fri Oct 01 18:21:11 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:12 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.5-rc1config
[Fri Oct 01 18:21:12 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:12 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.5-rc2
[Fri Oct 01 18:21:12 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:13 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.5
[Fri Oct 01 18:21:13 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:13 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.6-rc1
[Fri Oct 01 18:21:13 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:13 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.6-rc2
[Fri Oct 01 18:21:13 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:14 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.6
[Fri Oct 01 18:21:14 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:14 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2


[Fri Oct 01 18:21:14 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:15 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/
phpMyAdmin
[Fri Oct 01 18:21:15 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:15 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/
phpMyAdmin2
[Fri Oct 01 18:21:15 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:16 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/
phpmanager
[Fri Oct 01 18:21:16 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:16 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/
phpmy-admin
[Fri Oct 01 18:21:16 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:17 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/
phpmyadmin
[Fri Oct 01 18:21:17 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:17 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/
phpmyadmin2
[Fri Oct 01 18:21:17 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:17 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/
pma
[Fri Oct 01 18:21:17 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:18 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/pma2005



當然不是只有這些紀錄,實際上有N倍這麼多,也難怪httpd會癱掉
把這段貼出來是因為掃視log的時候其中有幾行引起我的注意
擺明了就是要找phpmyadmin的路徑,除了紅色那幾行
是試探有沒有管理者懶到把phpmyadmin解開丟進去,連改名字都不改的
然後藍色的字串是試探雖然沒有懶到不改目錄名稱,但是也沒有多用心去改的 XD
所以阿,大家可不要便宜行事,最好再加些防護措施吧,除了mysql密碼不能太簡單
也可以考慮對目錄讀取做控管等等方式。
唉~看來應該要抽個空幫server作個體檢了,不過在那之前,先把這IP給ban掉再說!XD

留言