Visit Jeremy's Blog.
Go Back > Forums > Linux Forums > Linux - Security
User Name
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.


  Search this Thread
Old 02-08-2006, 01:38 PM   #1
Registered: Dec 2005
Location: NC, USA
Distribution: (K)ubuntu
Posts: 139

Rep: Reputation: 15
Block URL request in server

Our server has been getting probed for security holes. We want to block some URL requests to help prevent the probes. We have things like

404 Not Found
/awstats/|echo;echo%2 ... cho%20YYY;echo|: 1 Time(s)
/blog/xmlrpc.php: 1 Time(s)
/blog/xmlsrv/xmlrpc.php: 1 Time(s)
/blogs/xmlsrv/xmlrpc.php: 1 Time(s)

in our logwatch file. In /etc/httpd/conf/httpd.conf, at the bottom, there are some blocks already in place of a different type:

RewriteCond %{HTTP_USER_AGENT} SurveyBot [OR] # rude bot
RewriteCond %{HTTP_USER_AGENT} tele(port|soft) [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} TurnitinBot [OR] # Turnitin spybot

How can I do the same kind of thing, but for URLs?
Old 02-08-2006, 08:03 PM   #2
Senior Member
Registered: Sep 2002
Location: Philippines
Distribution: Slackware, RHEL&variants, AIX, SuSE
Posts: 1,127

Rep: Reputation: 49
Old 02-08-2006, 09:16 PM   #3
Senior Member
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 69
Also take a look at the mod_rewrite guide as well. Since you are already using mod_rewrite anyway, you can use it to deny URLs containing common malicious strings like "awstats" and "xmlrpc" (as long as you aren't actually using either) and the ubiquitous "cmd.exe". Mod_rewrite is extremely powerfull and you can use it to match all different parts of the HTTP request, not just the URL. The hardest part is usually coming up with the proper regular expression.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
ERROR The requested URL could not be retrieved While trying to retrieve the URL: /re Niceman2005 Linux - General 1 06-29-2005 09:51 AM
ssh server request k1ll3r_x Linux - Networking 4 04-20-2005 03:27 PM
Use apache to rewrite to external server and keep same browser URL ijsman77 Linux - Software 1 04-09-2004 07:32 AM
Redirecting URL to another server wilcoNL Linux - Software 3 04-05-2004 07:00 AM
Unable to run webpage on local server using ip in the url MakingOfAGeek Linux - Newbie 16 11-15-2003 07:09 AM

All times are GMT -5. The time now is 03:34 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration