LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices



Reply
 
Search this Thread
Old 02-08-2006, 02:38 PM   #1
spiffytech
Member
 
Registered: Dec 2005
Location: NC, USA
Distribution: (K)ubuntu
Posts: 139

Rep: Reputation: 15
Block URL request in server


Our server has been getting probed for security holes. We want to block some URL requests to help prevent the probes. We have things like





404 Not Found
/awstats/awstats.pl?configdir=|echo;echo%2 ... cho%20YYY;echo|: 1 Time(s)
/blog/xmlrpc.php: 1 Time(s)
/blog/xmlsrv/xmlrpc.php: 1 Time(s)
/blogs/xmlsrv/xmlrpc.php: 1 Time(s)


in our logwatch file. In /etc/httpd/conf/httpd.conf, at the bottom, there are some blocks already in place of a different type:

RewriteCond %{HTTP_USER_AGENT} SurveyBot [OR] # rude bot
RewriteCond %{HTTP_USER_AGENT} tele(port|soft) [NC,OR] # OD
RewriteCond %{HTTP_USER_AGENT} TurnitinBot [OR] # Turnitin spybot


How can I do the same kind of thing, but for URLs?
 
Old 02-08-2006, 09:03 PM   #2
born4linux
Senior Member
 
Registered: Sep 2002
Location: Philippines
Distribution: Slackware, RHEL&variants, AIX, SuSE
Posts: 1,127

Rep: Reputation: 49
http://httpd.apache.org/docs/2.0/mis...rity_tips.html
 
Old 02-08-2006, 10:16 PM   #3
Capt_Caveman
Senior Member
 
Registered: Mar 2003
Distribution: Fedora
Posts: 3,658

Rep: Reputation: 57
Also take a look at the mod_rewrite guide as well. Since you are already using mod_rewrite anyway, you can use it to deny URLs containing common malicious strings like "awstats" and "xmlrpc" (as long as you aren't actually using either) and the ubiquitous "cmd.exe". Mod_rewrite is extremely powerfull and you can use it to match all different parts of the HTTP request, not just the URL. The hardest part is usually coming up with the proper regular expression.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
ERROR The requested URL could not be retrieved While trying to retrieve the URL: /re Niceman2005 Linux - General 1 06-29-2005 10:51 AM
ssh server request k1ll3r_x Linux - Networking 4 04-20-2005 04:27 PM
Use apache to rewrite to external server and keep same browser URL ijsman77 Linux - Software 1 04-09-2004 08:32 AM
Redirecting URL to another server wilcoNL Linux - Software 3 04-05-2004 08:00 AM
Unable to run webpage on local server using ip in the url MakingOfAGeek Linux - Newbie 16 11-15-2003 08:09 AM


All times are GMT -5. The time now is 04:49 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration