You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Ruiyuan Jiang <RJ...@fnpc.com> on 2012/06/12 06:42:08 UTC
[users@httpd] Attack on my reverse proxy server
Hi, all
We see some attack on our apache reverse proxy server.
180.211.101.213 - - [11/Jun/2012:11:30:00 -400] "POST / HTTP/1.0" 301 324
201.243.47.144 - - [11/Jun/2012:11:30:00 -400] "POST / HTTP/1.0" 400 226
113.162.230.163 - - [11/Jun/2012:11:30:00 -400] "POST / HTTP/1.0" 503 323
How can we block those activities on the apache server? Thanks.
Ryan Jiang
This message (including any attachments) is intended
solely for the specific individual(s) or entity(ies) named
above, and may contain legally privileged and
confidential information. If you are not the intended
recipient, please notify the sender immediately by
replying to this message and then delete it.
Any disclosure, copying, or distribution of this message,
or the taking of any action based on it, by other than the
intended recipient, is strictly prohibited.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] Attack on my reverse proxy server
Posted by Ruiyuan Jiang <RJ...@fnpc.com>.
Thanks Matus
Actually we see a lot of POST command from lots different IPs around the world and our site was took down (very slow).
-----Original Message-----
From: Matus UHLAR - fantomas [mailto:uhlar@fantomas.sk]
Sent: Tuesday, June 12, 2012 7:05 AM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Attack on my reverse proxy server
On 12.06.12 00:42, Ruiyuan Jiang wrote:
>We see some attack on our apache reverse proxy server.
>
>180.211.101.213 - - [11/Jun/2012:11:30:00 -400] "POST / HTTP/1.0" 301 324
>201.243.47.144 - - [11/Jun/2012:11:30:00 -400] "POST / HTTP/1.0" 400 226
>113.162.230.163 - - [11/Jun/2012:11:30:00 -400] "POST / HTTP/1.0" 503 323
>
>How can we block those activities on the apache server? Thanks.
if your server is accessible from the internet, such attacks _will_ come.
you should make sure that such attacks won't affect its functionality.
you can watch logs for that kind of activities and e.g. block source
IPs in firewall (a.g. using fail2ban).
There apparently are apache modules that can to something similar
internally.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
A day without sunshine is like, night.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
This message (including any attachments) is intended
solely for the specific individual(s) or entity(ies) named
above, and may contain legally privileged and
confidential information. If you are not the intended
recipient, please notify the sender immediately by
replying to this message and then delete it.
Any disclosure, copying, or distribution of this message,
or the taking of any action based on it, by other than the
intended recipient, is strictly prohibited.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Attack on my reverse proxy server
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 12.06.12 00:42, Ruiyuan Jiang wrote:
>We see some attack on our apache reverse proxy server.
>
>180.211.101.213 - - [11/Jun/2012:11:30:00 -400] "POST / HTTP/1.0" 301 324
>201.243.47.144 - - [11/Jun/2012:11:30:00 -400] "POST / HTTP/1.0" 400 226
>113.162.230.163 - - [11/Jun/2012:11:30:00 -400] "POST / HTTP/1.0" 503 323
>
>How can we block those activities on the apache server? Thanks.
if your server is accessible from the internet, such attacks _will_ come.
you should make sure that such attacks won't affect its functionality.
you can watch logs for that kind of activities and e.g. block source
IPs in firewall (a.g. using fail2ban).
There apparently are apache modules that can to something similar
internally.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
A day without sunshine is like, night.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org