attacchi?

[Sunchaser]

Ciao, saluti a tutti, nel log error_log del mio vps ho visto questi tentativi di accesso:

[Sun Oct 10 13:27:46 2010] [error] [client 80.82.209.214] File does not exist: /var/www/vhosts/default/htdocs/p
[Sun Oct 10 13:27:46 2010] [error] [client 80.82.209.214] File does not exist: /var/www/vhosts/default/htdocs/PMA2005
[Sun Oct 10 13:27:46 2010] [error] [client 80.82.209.214] File does not exist: /var/www/vhosts/default/htdocs/pma2005
[Sun Oct 10 13:27:46 2010] [error] [client 80.82.209.214] File does not exist: /var/www/vhosts/default/htdocs/phpmanager
[Sun Oct 10 13:27:46 2010] [error] [client 80.82.209.214] File does not exist: /var/www/vhosts/default/htdocs/php-myadmin
[Sun Oct 10 13:27:47 2010] [error] [client 80.82.209.214] File does not exist: /var/www/vhosts/default/htdocs/phpmy-admin
[Sun Oct 10 13:27:47 2010] [error] [client 80.82.209.214] File does not exist: /var/www/vhosts/default/htdocs/webadmin
[Sun Oct 10 13:27:48 2010] [error] [client 80.82.209.214] File does not exist: /var/www/vhosts/default/htdocs/sqlweb
[Sun Oct 10 13:27:48 2010] [error] [client 80.82.209.214] File does not exist: /var/www/vhosts/default/htdocs/websql
[Sun Oct 10 13:27:48 2010] [error] [client 80.82.209.214] File does not exist: /var/www/vhosts/default/htdocs/webdb
[Sun Oct 10 13:27:48 2010] [error] [client 80.82.209.214] File does not exist: /var/www/vhosts/default/htdocs/mysqladmin
[Sun Oct 10 13:27:48 2010] [error] [client 80.82.209.214] File does not exist: /var/www/vhosts/default/htdocs/mysql-admin
[Mon Oct 11 02:53:28 2010] [error] [client 222.45.112.59] script '/var/www/vhosts/default/htdocs/check.php' not found or unable to stat
[Mon Oct 11 04:23:27 2010] [error] [client 193.151.98.220] Invalid URI in request GET HTTP/1.1 HTTP/1.1
[Mon Oct 11 04:23:29 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/roundcube
[Mon Oct 11 04:23:30 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/rc
[Mon Oct 11 04:23:32 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/mss2
[Mon Oct 11 04:23:33 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/mail
[Mon Oct 11 04:23:35 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/mail2
[Mon Oct 11 04:23:36 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/roundcubemail
[Mon Oct 11 04:23:38 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/rms
[Mon Oct 11 04:23:39 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/webmail2
[Mon Oct 11 04:23:41 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/webmail
[Mon Oct 11 04:23:43 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/wm
[Mon Oct 11 04:23:44 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/bin
[Mon Oct 11 04:23:45 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/roundcubemail-0.1
[Mon Oct 11 04:23:47 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/roundcubemail-0.2
[Mon Oct 11 04:23:48 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/roundcube-0.1
[Mon Oct 11 04:23:50 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/roundcube-0.2
[Mon Oct 11 04:23:51 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/round
[Mon Oct 11 04:23:53 2010] [error] [client 193.151.98.220] File does not exist: /var/www/vhosts/default/htdocs/cube

Cosa posso fare per difendermi, escludere gli ip address tramite il firewall di plesk?

grazie.

[Rebel]

oddio, quel tipo di attacchi li avrai sempre. di regola assicurati sempre di mettere programmi come phpmyadmin o aree admin dei cms, dietro autenticazione http.

poi puoi installare mod_security ed impostare alcuni filtri per bloccare gli accessi a quel tipo di url.

[cxcs]

Ciao Sunchaser, con Fail2ban puoi tenere alla larga grattacapi di questo tipo.

[Sunchaser]

grazie dei consigli

[WizOfOz]

si ma attento a non bloccare troppe cose o blocchi anche i visitatori che semplicemente sbagliano URL