亂槍打鳥?

這幾天cciilin跟我說，伺服器怪怪的，有時候httpd會癱掉
去檢查了一下log發現還真是莫名其妙，原來是被機器人狂掃

[Fri Oct 01 18:21:06 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/myadmin
[Fri Oct 01 18:21:06 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:06 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/mysql-admin
[Fri Oct 01 18:21:06 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:06 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/mysql
[Fri Oct 01 18:21:06 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:07 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/mysqladminconfig
[Fri Oct 01 18:21:07 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:07 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/mysqlmanager
[Fri Oct 01 18:21:07 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:08 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/p
[Fri Oct 01 18:21:08 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:08 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/pMA
[Fri Oct 01 18:21:08 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:09 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/php-my-admin
[Fri Oct 01 18:21:09 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:09 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/php-myadmin
[Fri Oct 01 18:21:09 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:10 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.2.3
[Fri Oct 01 18:21:10 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:10 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.2.6
[Fri Oct 01 18:21:10 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:10 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.1
[Fri Oct 01 18:21:10 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:11 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.4
[Fri Oct 01 18:21:11 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:11 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.5-pl1
[Fri Oct 01 18:21:11 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:12 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.5-rc1config
[Fri Oct 01 18:21:12 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:12 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.5-rc2
[Fri Oct 01 18:21:12 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:13 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.5
[Fri Oct 01 18:21:13 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:13 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.6-rc1
[Fri Oct 01 18:21:13 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:13 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.6-rc2
[Fri Oct 01 18:21:13 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:14 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2.5.6
[Fri Oct 01 18:21:14 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:14 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin-2

[Fri Oct 01 18:21:14 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:15 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin
[Fri Oct 01 18:21:15 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:15 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpMyAdmin2
[Fri Oct 01 18:21:15 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:16 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpmanager
[Fri Oct 01 18:21:16 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:16 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpmy-admin
[Fri Oct 01 18:21:16 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:17 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpmyadmin
[Fri Oct 01 18:21:17 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:17 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/phpmyadmin2
[Fri Oct 01 18:21:17 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:17 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/pma
[Fri Oct 01 18:21:17 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/my_error
[Fri Oct 01 18:21:18 2010] [error] [client 200.76.17.194] File does not exist: /var/www/html/pma2005

---

當然不是只有這些紀錄，實際上有N倍這麼多，也難怪httpd會癱掉
把這段貼出來是因為掃視log的時候其中有幾行引起我的注意
擺明了就是要找phpmyadmin的路徑，除了紅色那幾行
是試探有沒有管理者懶到把phpmyadmin解開丟進去，連改名字都不改的
然後藍色的字串是試探雖然沒有懶到不改目錄名稱，但是也沒有多用心去改的 XD
所以阿，大家可不要便宜行事，最好再加些防護措施吧，除了mysql密碼不能太簡單
也可以考慮對目錄讀取做控管等等方式。
唉~看來應該要抽個空幫server作個體檢了，不過在那之前，先把這IP給ban掉再說！XD