http зондирование, защита есть?

0

1

Периодически появляется вот такой лог:

400 Bad Request
       /: 10 Time(s)
       /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd: 1 Time(s)
       /%5C%5C..%2f..%2f..%2f..%2fboot.ini%%20../: 1 Time(s)
       /%NETHOOD%/: 1 Time(s)
       /static/../../../../../../../../../etc/passwd.: 1 Time(s)
       @localhost: 1 Time(s)
       HTTP/1.1: 1 Time(s)
403 Forbidden
       /cgi-bin/index.php: 24 Time(s)
       /cgi-bin/status: 14 Time(s)
       /cgi-bin/test: 13 Time(s)
.......
404 Not Found
       /index.php: 23 Time(s)
       /scripts/index.php: 17 Time(s)
       /dasdec/dasdec.csp: 16 Time(s)
       /admin/admin.php: 2 Time(s)
........

Явное зондирование. Есть ли способ защиты от этих сканеров? Fail2ban может перенастроить?

Ссылка

нашел решение сам

Решение нашлось быстро, включаем защиту apache2 в /etc/fail2ban/jail.local :

# detect password authentication failures
[apache]
enabled  = true
port     = http,https
filter   = apache-auth
logpath  = /var/log/apache2/error.log
maxretry = 6
 
# detect potential search for exploits and php vulnerabilities
[apache-noscript]
enabled  = true
port     = http,https
filter   = apache-noscript
logpath  = /var/log/apache2/error.log
maxretry = 6
 
# detect Apache overflow attempts
[apache-overflows]
enabled  = true
port     = http,https
filter   = apache-overflows
logpath  = /var/log/apache2/error.log
maxretry = 2
 
# detect failures to find a home directory on a server
[apache-nohome]
enabled  = true
port     = http,https
filter   = apache-nohome
logpath  = /var/log/apache2/error.log
maxretry = 2

Dimarius ★
(25.08.16 09:54:13 MSK) автор топика

нашел решение сам

Похожие темы