You might like the application called fail2ban. Instead of rate limiting the connections, which could and probably will impact valid users, you can target the script kiddies directly. I too received an attempt to locate myadmin on my site, which I do have, but it is not accessible via a public interface; the important point being that their URL guessing FAILS. With fail2ban, too many attempts to access invalid URL will result in a temporary blockage of their IP address. >99.99% of the time this is sufficient to make them go away.
Here is a log output from my fail2ban from yesterday which stopped this same activity cold:
Code:
2011-02-03 15:16:23,830 fail2ban.actions: WARNING [apache] Ban 82.208.56.105
2011-02-03 15:16:24,852 fail2ban.actions: WARNING [apache] 82.208.56.105 already banned
This particular one managed to get more connection attempts than normal before fail2ban was able to stop them, 19 total, but this occurred in about a two second window. Notice that the fail2ban log tried to ban them twice, which was based upon the number of log entries, but once triggered the first time they were shut down. See the following error logs:
Code:
[Thu Feb 03 15:16:21 2011] [error] [client 82.208.56.105] File does not exist: /var/www-ssl/scripts
[Thu Feb 03 15:16:21 2011] [error] [client 82.208.56.105] Re-negotiation request failed
[Thu Feb 03 15:16:21 2011] [error] SSL Library Error: 336068931 error:14080143:SSL routines:SSL3_ACCEPT:unsafe legacy renegotiation disabled
[Thu Feb 03 15:16:22 2011] [error] [client 82.208.56.105] File does not exist: /var/www-ssl/pma
[Thu Feb 03 15:16:22 2011] [error] [client 82.208.56.105] File does not exist: /var/www-ssl/mysql
[Thu Feb 03 15:16:22 2011] [error] [client 82.208.56.105] File does not exist: /var/www-ssl/phpMyAdmin
[Thu Feb 03 15:16:22 2011] [error] [client 82.208.56.105] File does not exist: /var/www-ssl/scripts
[Thu Feb 03 15:16:22 2011] [error] [client 82.208.56.105] Re-negotiation request failed
[Thu Feb 03 15:16:22 2011] [error] SSL Library Error: 336068931 error:14080143:SSL routines:SSL3_ACCEPT:unsafe legacy renegotiation disabled
[Thu Feb 03 15:16:22 2011] [error] [client 82.208.56.105] File does not exist: /var/www-ssl/pma
[Thu Feb 03 15:16:22 2011] [error] [client 82.208.56.105] File does not exist: /var/www-ssl/mysql
[Thu Feb 03 15:16:22 2011] [error] [client 82.208.56.105] File does not exist: /var/www/scripts
[Thu Feb 03 15:16:23 2011] [error] [client 82.208.56.105] File does not exist: /var/www-ssl/phpMyAdmin
[Thu Feb 03 15:16:23 2011] [error] [client 82.208.56.105] access to /usr/share/phpmyadmin/scripts failed, reason: SSL connection required
[Thu Feb 03 15:16:23 2011] [error] [client 82.208.56.105] File does not exist: /var/www/pma
[Thu Feb 03 15:16:23 2011] [error] [client 82.208.56.105] File does not exist: /var/www/mysql
[Thu Feb 03 15:16:23 2011] [error] [client 82.208.56.105] File does not exist: /var/www/phpMyAdmin
[Thu Feb 03 15:16:23 2011] [error] [client 82.208.56.105] File does not exist: /var/www/scripts
[Thu Feb 03 15:16:23 2011] [error] [client 82.208.56.105] access to /usr/share/phpmyadmin/scripts failed, reason: SSL connection required
[Thu Feb 03 15:16:23 2011] [error] [client 82.208.56.105] File does not exist: /var/www/pma
[Thu Feb 03 15:16:23 2011] [error] [client 82.208.56.105] File does not exist: /var/www/mysql
