Topic: Apache Security Answer

[BIODIGITZMAN]

Hola!

i have a one Problem in:

Apache 2.2.8
php5.2.5
MySql 6

Server localhost in Windows Vista Ultimate sp1

i Have one Abusive conecttion IP SYN_RCVD

Via apache :

i Have :

1. Apache ModSecurity 2.1.4
2. .htacces banned this ip 78.136.122.61
3. .htacces banned this ip 78.136.122.
4. .htacces banned this ip 78.136.
5. .htacces banned this rang 78. Full Banned
6. acces.conf banned this IP
7. http.conf banned this ip

Banned from all conf possibles and. nothing


this conecttion external is constantly

Pd: This IP no have Reverse


¿What i can do for banned this *** IP ?

Thanks

[James Blond]

Hi!
If you are using a router to connect to the internet, you maybe can block that IP there. But that is only a moving from the problem to the router.
From Apache side you can't do more than banning the ip with deny.

[BIODIGITZMAN]

Currently, the attack has ceased.

The problem is that I can not access the web config of my router

My router is closed by my ISP

Moment of the attack has stopped. Will be continued if

Thanks to respond if something happens again it comment

[BIODIGITZMAN]

in .htacces :

[James Blond]

[BIODIGITZMAN]

I never usu nothing in that folder. Even exist ..

Put there because the error log apache. Marked these connections> ping.asp

That's why I .. But if I look Remove this folder:


[Fri Feb 15 10:10:41 2008] [error] [client 201.246.44.254] File does not exist: Rootfolder/htdocs/Updates
[Fri Feb 15 10:10:51 2008] [error] [client 79.147.153.176] File does not exist: Rootfolder/htdocs/Updates



I never have configured nothing whit this folder updates


Only got there because. Apache error log always full of that error



Now this cleared. But all connections want to ping.asp on my server ...

That is what I do not understand .. Because a ping.asp? On my server?

[glsmith]

Seeing that this is coming from more than one IP, I'd say it is a bot attack of a known vulnerability in ping.asp. Many of these bots that attack webservers do not look to see if you are running IIS or Apache or anything else, they just sweep a bunch of IP addresses.

Looking up ping.asp, it is vulnerable to DDOSing it's own server.

I get tons of attacks on stuff that does not exist. Those of us that have been around long enough remember the pollution in our logs Code Red and Code Red II left. We were using Apache so we were safe. Those using unpatched IIS were not.

For years I have never had PHP, there wasn't anything PHP that I could not find an equivalent for in Perl. Yet I still got tons of hits looking for PHP apps like Webblog and others that had known vulnerabilities.


It's just part of the game.