Since a few days my apache webserver is under attack. I get multiple requests to non-existant pages from multiple IP's. Is there anything I can do to stop it besides shutting down my apache server?
Currently I have closed port 80 to stop the logs filling up. Here is a part of my error.log:
[Tue Aug 16 17:12:55 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/view.aspx, referer: http://www.gamesfox.info/
[Tue Aug 16 17:12:55 2011] [error] [client xxx.xxx.xxx.xxx] script '/var/www/login.php' not found or unable to stat, referer: http://www.wi8357.com/login.php
[Tue Aug 16 17:12:55 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/addyn, referer: http://www.dodomains.net
[Tue Aug 16 17:12:55 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.addictedpeople.com
[Tue Aug 16 17:12:56 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/toindex1.asp, referer: http://98.126.93.27/toindex1.asp
[Tue Aug 16 17:12:56 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.zopm.com
[Tue Aug 16 17:12:56 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.zopm.com
[Tue Aug 16 17:12:56 2011] [error] [client xxx.xxx.xxx.xxx] script '/var/www/xml.php' not found or unable to stat
[Tue Aug 16 17:12:56 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/config
[Tue Aug 16 17:12:57 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/addyn, referer: http://www.hypeshot.com
[Tue Aug 16 17:12:57 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/toindex1.asp, referer: http://98.126.93.27/toindex1.asp
[Tue Aug 16 17:12:57 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/addyn, referer: http://www.gkkv.com
[Tue Aug 16 17:12:57 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.iyens.com
[Tue Aug 16 17:12:57 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.titist.com
[Tue Aug 16 17:12:57 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.yfia.com
[Tue Aug 16 17:12:58 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/addyn, referer: http://www.abundancegames.com
[Tue Aug 16 17:12:58 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.chiefwork.com
[Tue Aug 16 17:12:58 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/pp, referer: http://www.thirdgames.com
[Tue Aug 16 17:12:58 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/toindex1.asp, referer: http://98.126.93.27/toindex1.asp
[Tue Aug 16 17:12:58 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.newbiegamer.com
[Tue Aug 16 17:12:58 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://luxuryup.com
[Tue Aug 16 17:12:59 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/st, referer: http://www.monopolyfreegame.com
[Tue Aug 16 17:12:59 2011] [error] [client xxx.xxx.xxx.xxx] File does not exist: /var/www/pp, referer: http://luxuryup.com/
[Tue Aug 16 17:13:02 2011] [error] [client xxx.xxx.xxx.xxx] script '/var/www/login.php' not found or unable to stat, referer: http://www.wi8357.com/login.php
[Tue Aug 16 17:13:02 2011] [error] [client xxx.xxx.xxx.xxx] script '/var/www/index.php' not found or unable to stat, referer: http://www.fire35.com
They are all different IP's, so my brute-force protection in iptables does not help.
Any suggestions?
Best Answer
I was googling around, and found this :
http://mediakey.dk/~cc/block-referer-spam/
It seems there is a special module for apache2 to prevent referrer spam.
or
A more manual method with iptables :
http://www.iospirit.com/blog/article/12/Linux-HowTo-Defeating-referer-spam/