Scriptkiddy nerven über URL



Lord_Icon

Lord_Icon

Member
Moin,

ich hab da anscheind n Scriptkiddy an der Backe der mein Apachen zu abstürzen bringt.

In den Logs finde ich:
Code: 
mailserver.my-domain.de 178.xxx.178.xxx - - [13/Feb/2012:15:46:03 +0100] "A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A cat is fine too. Desudesudesu~A c" 414 250 "-" "-"

Und das meist mehrfach die Sekunde. Nur weiß ich nicht, wie er diesen Eintrag schafft. Normalerweise ist in den Logs eine Website angegeben sodass ich den Spinner über die .htaccess abweisen kann.

Hab die IP einfach mal in die deny.hosts (ALL: 178.xxx.178.xxx) eingetragen... in der Hoffnung, dass das was hilft. LEider nicht.

Habe ich andere Möglichkeiten, die einfach und schnell umzusetzen sind... ohne dass ich X-Tools einbauen und diese erst umständlich konfigurieren muß ?

Danke
 
wie wäre es mit iptables?

iptables -I INPUT -s 178.xxx.178.xxx -j DROP

Ich kann dir auch den Einsatz von Fail2Ban empfehlen.

--
Gruß
Nero
 
mod_evasive hilft vielleicht ein bisschen.

iptables? Wenn das Skriptbubi den Server wechselt oder ein Botnetz hat, kommste nicht mehr manuell hinterher.
Also fail2ban verwenden und das error_log automatisch auf den HTTP-Fehlercode 414 scannen lassen und dann die IP bannen.
 
Drei Möglichkeiten die Sinn machen:

  • connections per iptables pro client limitieren
  • nginx als reverse proxy vorschalten (der macht ein wenig mehr mit als apache)
  • shellscript in verbindung mit cronjob basteln um via awk die bösen bubis auszufiltern und via iptables kicken
 
Last edited by a moderator:
You must log in or register to reply here.
Back
Top