Amazon EC2 instance is getting spammed with different PHP filenames
Our server has been attacked recently and looks something like the following in the logs:
[Mon Feb 18 09:18:43 2019] [IP_ADDRESS] script '/var/www/ynm.php' not found or unable to stat
[Mon Feb 18 09:18:43 2019] [IP_ADDRESS] script '/var/www/71.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/wadre.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/vm.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/test.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/1q.php' not found or unable to stat
[Mon Feb 18 09:18:45 2019] [IP_ADDRESS] script '/var/www/1111.php' not found or unable to stat
[Mon Feb 18 09:18:45 2019] [IP_ADDRESS] script '/var/www/errors.php' not found or unable to stat
[Mon Feb 18 09:18:46 2019] [IP_ADDRESS] script '/var/www/q.php' not found or unable to stat
These attacks go on for hours sometimes and freezes the server.
How to protect against this? fail2ban?
Have banned the IP's manually but they change every time.
Thanks!
php amazon-web-services amazon-ec2 apache-2.4
edited 4 hours ago
MLu
8,14212141
asked 4 hours ago
WKFYWKFY
161
New contributor
WKFY is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
Our server has been attacked recently and looks something like the following in the logs:
[Mon Feb 18 09:18:43 2019] [IP_ADDRESS] script '/var/www/ynm.php' not found or unable to stat
[Mon Feb 18 09:18:43 2019] [IP_ADDRESS] script '/var/www/71.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/wadre.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/vm.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/test.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/1q.php' not found or unable to stat
[Mon Feb 18 09:18:45 2019] [IP_ADDRESS] script '/var/www/1111.php' not found or unable to stat
[Mon Feb 18 09:18:45 2019] [IP_ADDRESS] script '/var/www/errors.php' not found or unable to stat
[Mon Feb 18 09:18:46 2019] [IP_ADDRESS] script '/var/www/q.php' not found or unable to stat
These attacks go on for hours sometimes and freezes the server.
How to protect against this? fail2ban?
Have banned the IP's manually but they change every time.
Thanks!
php amazon-web-services amazon-ec2 apache-2.4
edited 4 hours ago
MLu
8,14212141
asked 4 hours ago
WKFYWKFY
161
New contributor
WKFY is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1
fail2banis appropriate here, but you should probably figure out why a couple of 404s per second (which should consume very minimal resources) crash your server too.
– ceejayoz
4 hours ago
You could whitelist CloudFront IP ranges in security groups, which enforces requests going through CloudFront. Integrate AWS WAF with CloudFront, which includes AWS Shield, and that may help to reduce this. Custom WAF rules should enhance protection. Use this AWS script to keep the CloudFront IPs up to date.
– Tim
22 mins ago
add a comment |
Our server has been attacked recently and looks something like the following in the logs:
[Mon Feb 18 09:18:43 2019] [IP_ADDRESS] script '/var/www/ynm.php' not found or unable to stat
[Mon Feb 18 09:18:43 2019] [IP_ADDRESS] script '/var/www/71.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/wadre.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/vm.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/test.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/1q.php' not found or unable to stat
[Mon Feb 18 09:18:45 2019] [IP_ADDRESS] script '/var/www/1111.php' not found or unable to stat
[Mon Feb 18 09:18:45 2019] [IP_ADDRESS] script '/var/www/errors.php' not found or unable to stat
[Mon Feb 18 09:18:46 2019] [IP_ADDRESS] script '/var/www/q.php' not found or unable to stat
These attacks go on for hours sometimes and freezes the server.
How to protect against this? fail2ban?
Have banned the IP's manually but they change every time.
Thanks!
php amazon-web-services amazon-ec2 apache-2.4
edited 4 hours ago
MLu
8,14212141
asked 4 hours ago
WKFYWKFY
161
New contributor
WKFY is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Our server has been attacked recently and looks something like the following in the logs:
[Mon Feb 18 09:18:43 2019] [IP_ADDRESS] script '/var/www/ynm.php' not found or unable to stat
[Mon Feb 18 09:18:43 2019] [IP_ADDRESS] script '/var/www/71.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/wadre.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/vm.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/test.php' not found or unable to stat
[Mon Feb 18 09:18:44 2019] [IP_ADDRESS] script '/var/www/1q.php' not found or unable to stat
[Mon Feb 18 09:18:45 2019] [IP_ADDRESS] script '/var/www/1111.php' not found or unable to stat
[Mon Feb 18 09:18:45 2019] [IP_ADDRESS] script '/var/www/errors.php' not found or unable to stat
[Mon Feb 18 09:18:46 2019] [IP_ADDRESS] script '/var/www/q.php' not found or unable to stat
These attacks go on for hours sometimes and freezes the server.
How to protect against this? fail2ban?
Have banned the IP's manually but they change every time.
Thanks!
php amazon-web-services amazon-ec2 apache-2.4
php amazon-web-services amazon-ec2 apache-2.4
edited 4 hours ago
MLu
8,14212141
asked 4 hours ago
WKFYWKFY
161
New contributor
WKFY is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 4 hours ago
MLu
8,14212141
asked 4 hours ago
WKFYWKFY
161
New contributor
WKFY is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 4 hours ago
MLu
8,14212141
edited 4 hours ago
MLu
8,14212141
edited 4 hours ago
MLu
8,14212141
8,14212141
asked 4 hours ago
WKFYWKFY
161
New contributor
WKFY is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 4 hours ago
WKFYWKFY
161
asked 4 hours ago
WKFYWKFY
161
161
New contributor
WKFY is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
WKFY is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
WKFY is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1
fail2banis appropriate here, but you should probably figure out why a couple of 404s per second (which should consume very minimal resources) crash your server too.
– ceejayoz
4 hours ago
You could whitelist CloudFront IP ranges in security groups, which enforces requests going through CloudFront. Integrate AWS WAF with CloudFront, which includes AWS Shield, and that may help to reduce this. Custom WAF rules should enhance protection. Use this AWS script to keep the CloudFront IPs up to date.
– Tim
22 mins ago
add a comment |
1
fail2banis appropriate here, but you should probably figure out why a couple of 404s per second (which should consume very minimal resources) crash your server too.
– ceejayoz
4 hours ago
You could whitelist CloudFront IP ranges in security groups, which enforces requests going through CloudFront. Integrate AWS WAF with CloudFront, which includes AWS Shield, and that may help to reduce this. Custom WAF rules should enhance protection. Use this AWS script to keep the CloudFront IPs up to date.
– Tim
22 mins ago
1
1
fail2ban is appropriate here, but you should probably figure out why a couple of 404s per second (which should consume very minimal resources) crash your server too.– ceejayoz
4 hours ago
fail2ban is appropriate here, but you should probably figure out why a couple of 404s per second (which should consume very minimal resources) crash your server too.– ceejayoz
4 hours ago
You could whitelist CloudFront IP ranges in security groups, which enforces requests going through CloudFront. Integrate AWS WAF with CloudFront, which includes AWS Shield, and that may help to reduce this. Custom WAF rules should enhance protection. Use this AWS script to keep the CloudFront IPs up to date.
– Tim
22 mins ago
You could whitelist CloudFront IP ranges in security groups, which enforces requests going through CloudFront. Integrate AWS WAF with CloudFront, which includes AWS Shield, and that may help to reduce this. Custom WAF rules should enhance protection. Use this AWS script to keep the CloudFront IPs up to date.
– Tim
22 mins ago
add a comment |
2 Answers
2
active
oldest
votes
These are common occurrences. Robots try to find insecure scripts and exploit them. You can't really avoid it, once you've got a web server on the Internet you'll see scans like this.
However since you're running on AWS EC2 you've got a number of options:
Use AWS WAF (Web Application Firewall) to protect your site against malicious attacks.
Use AWS Shield - managed DDoS protection. Free.
Etc...
In any case being scanned like this shouldn't freeze your server. That freezing is likely being caused by something else - maybe a DDoS (hint: use AWS Shield) or some successful exploit of one of your PHP scripts that consumes the instance memory.
Hope that helps :)
answered 4 hours ago
MLuMLu
8,14212141
add a comment |
You can use this app, it's very useful to me. It's Fail2ban integration for AWS
ACL.
https://www.cloudar.be/integrating-fail2ban-with-aws-network-acls/
answered 4 hours ago
PserrPserr
363
New contributor
Pserr is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
This may not work for long. AWS ACLs have a default limit of 20, and a maximum limit of 40 rules. docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html Most of the server logs I've seen of public instances would hit that limit in minutes.
– ceejayoz
3 hours ago
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "2"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
WKFY is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f954559%2famazon-ec2-instance-is-getting-spammed-with-different-php-filenames%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
These are common occurrences. Robots try to find insecure scripts and exploit them. You can't really avoid it, once you've got a web server on the Internet you'll see scans like this.
However since you're running on AWS EC2 you've got a number of options:
Use AWS WAF (Web Application Firewall) to protect your site against malicious attacks.
Use AWS Shield - managed DDoS protection. Free.
Etc...
In any case being scanned like this shouldn't freeze your server. That freezing is likely being caused by something else - maybe a DDoS (hint: use AWS Shield) or some successful exploit of one of your PHP scripts that consumes the instance memory.
Hope that helps :)
answered 4 hours ago
MLuMLu
8,14212141
add a comment |
These are common occurrences. Robots try to find insecure scripts and exploit them. You can't really avoid it, once you've got a web server on the Internet you'll see scans like this.
However since you're running on AWS EC2 you've got a number of options:
Use AWS WAF (Web Application Firewall) to protect your site against malicious attacks.
Use AWS Shield - managed DDoS protection. Free.
Etc...
In any case being scanned like this shouldn't freeze your server. That freezing is likely being caused by something else - maybe a DDoS (hint: use AWS Shield) or some successful exploit of one of your PHP scripts that consumes the instance memory.
Hope that helps :)
answered 4 hours ago
MLuMLu
8,14212141
add a comment |
These are common occurrences. Robots try to find insecure scripts and exploit them. You can't really avoid it, once you've got a web server on the Internet you'll see scans like this.
However since you're running on AWS EC2 you've got a number of options:
Use AWS WAF (Web Application Firewall) to protect your site against malicious attacks.
Use AWS Shield - managed DDoS protection. Free.
Etc...
In any case being scanned like this shouldn't freeze your server. That freezing is likely being caused by something else - maybe a DDoS (hint: use AWS Shield) or some successful exploit of one of your PHP scripts that consumes the instance memory.
Hope that helps :)
answered 4 hours ago
MLuMLu
8,14212141
These are common occurrences. Robots try to find insecure scripts and exploit them. You can't really avoid it, once you've got a web server on the Internet you'll see scans like this.
However since you're running on AWS EC2 you've got a number of options:
Use AWS WAF (Web Application Firewall) to protect your site against malicious attacks.
Use AWS Shield - managed DDoS protection. Free.
Etc...
In any case being scanned like this shouldn't freeze your server. That freezing is likely being caused by something else - maybe a DDoS (hint: use AWS Shield) or some successful exploit of one of your PHP scripts that consumes the instance memory.
Hope that helps :)
answered 4 hours ago
MLuMLu
8,14212141
answered 4 hours ago
MLuMLu
8,14212141
answered 4 hours ago
MLuMLu
8,14212141
answered 4 hours ago
MLuMLu
8,14212141
8,14212141
add a comment |
add a comment |
You can use this app, it's very useful to me. It's Fail2ban integration for AWS
ACL.
https://www.cloudar.be/integrating-fail2ban-with-aws-network-acls/
answered 4 hours ago
PserrPserr
363
New contributor
Pserr is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
This may not work for long. AWS ACLs have a default limit of 20, and a maximum limit of 40 rules. docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html Most of the server logs I've seen of public instances would hit that limit in minutes.
– ceejayoz
3 hours ago
add a comment |
You can use this app, it's very useful to me. It's Fail2ban integration for AWS
ACL.
https://www.cloudar.be/integrating-fail2ban-with-aws-network-acls/
answered 4 hours ago
PserrPserr
363
New contributor
Pserr is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
This may not work for long. AWS ACLs have a default limit of 20, and a maximum limit of 40 rules. docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html Most of the server logs I've seen of public instances would hit that limit in minutes.
– ceejayoz
3 hours ago
add a comment |
You can use this app, it's very useful to me. It's Fail2ban integration for AWS
ACL.
https://www.cloudar.be/integrating-fail2ban-with-aws-network-acls/
answered 4 hours ago
PserrPserr
363
New contributor
Pserr is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
You can use this app, it's very useful to me. It's Fail2ban integration for AWS
ACL.
https://www.cloudar.be/integrating-fail2ban-with-aws-network-acls/
answered 4 hours ago
PserrPserr
363
New contributor
Pserr is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 4 hours ago
PserrPserr
363
New contributor
Pserr is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 4 hours ago
PserrPserr
363
answered 4 hours ago
PserrPserr
363
363
New contributor
Pserr is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Pserr is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Pserr is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
This may not work for long. AWS ACLs have a default limit of 20, and a maximum limit of 40 rules. docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html Most of the server logs I've seen of public instances would hit that limit in minutes.
– ceejayoz
3 hours ago
add a comment |
This may not work for long. AWS ACLs have a default limit of 20, and a maximum limit of 40 rules. docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html Most of the server logs I've seen of public instances would hit that limit in minutes.
– ceejayoz
3 hours ago
This may not work for long. AWS ACLs have a default limit of 20, and a maximum limit of 40 rules. docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html Most of the server logs I've seen of public instances would hit that limit in minutes.
– ceejayoz
3 hours ago
This may not work for long. AWS ACLs have a default limit of 20, and a maximum limit of 40 rules. docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html Most of the server logs I've seen of public instances would hit that limit in minutes.
– ceejayoz
3 hours ago
add a comment |
WKFY is a new contributor. Be nice, and check out our Code of Conduct.
WKFY is a new contributor. Be nice, and check out our Code of Conduct.
WKFY is a new contributor. Be nice, and check out our Code of Conduct.
WKFY is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f954559%2famazon-ec2-instance-is-getting-spammed-with-different-php-filenames%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
fail2banis appropriate here, but you should probably figure out why a couple of 404s per second (which should consume very minimal resources) crash your server too.– ceejayoz
4 hours ago
You could whitelist CloudFront IP ranges in security groups, which enforces requests going through CloudFront. Integrate AWS WAF with CloudFront, which includes AWS Shield, and that may help to reduce this. Custom WAF rules should enhance protection. Use this AWS script to keep the CloudFront IPs up to date.
– Tim
22 mins ago