LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (http://www.linuxquestions.org/questions/linux-security-4/)
-   -   Block URL request in server (http://www.linuxquestions.org/questions/linux-security-4/block-url-request-in-server-413107/)

spiffytech 02-08-2006 01:38 PM

Block URL request in server
 
Our server has been getting probed for security holes. We want to block some URL requests to help prevent the probes. We have things like





404 Not Found
/awstats/awstats.pl?configdir=|echo;echo%2 ... cho%20YYY;echo|: 1 Time(s)
/blog/xmlrpc.php: 1 Time(s)
/blog/xmlsrv/xmlrpc.php: 1 Time(s)
/blogs/xmlsrv/xmlrpc.php: 1 Time(s)


in our logwatch file. In /etc/httpd/conf/httpd.conf, at the bottom, there are some blocks already in place of a different type:

RewriteCond %{HTTP_USER_AGENT} SurveyBot [OR] # rude bot
RewriteCond %{HTTP_USER_AGENT} tele(port|soft) [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} TurnitinBot [OR] # Turnitin spybot


How can I do the same kind of thing, but for URLs?

born4linux 02-08-2006 08:03 PM

http://httpd.apache.org/docs/2.0/mis...rity_tips.html

Capt_Caveman 02-08-2006 09:16 PM

Also take a look at the mod_rewrite guide as well. Since you are already using mod_rewrite anyway, you can use it to deny URLs containing common malicious strings like "awstats" and "xmlrpc" (as long as you aren't actually using either) and the ubiquitous "cmd.exe". Mod_rewrite is extremely powerfull and you can use it to match all different parts of the HTTP request, not just the URL. The hardest part is usually coming up with the proper regular expression.


All times are GMT -5. The time now is 10:56 PM.