Apache2 von Scriptkiddie abgeschossen?

[Exxter]

Hallo,

heute früh wunderte ich mich, dass auf einem Hetzner-Root-Server mit aktuellen Debian 9.5 der Apache2 nicht läuft. Hardware ist in Ordnung und Apache lies sich gleich wieder starten. In der Log steht:

Code: Alles auswählen

[...]
[Sat Sep 08 19:34:56.704181 2018] [:error] [pid 7121] [client 46.219.211.160:23616] script '/var/www/html/russian.php' not found or unable to stat, referer: http://www.google.com/
[Sat Sep 08 19:35:29.876918 2018] [:error] [pid 6395] [client 46.219.211.160:23811] script '/var/www/html/russian.php' not found or unable to stat, referer: http://www.google.com/
[Sat Sep 08 19:39:55.488104 2018] [:error] [pid 9397] [client 31.193.90.131:32962] script '/var/www/html/myiphb.php' not found or unable to stat
[Sat Sep 08 19:44:08.207257 2018] [:error] [pid 6395] [client 85.140.16.200:18231] script '/var/www/html/mif-drevney-grecii.php' not found or unable to stat, referer: http://yandex.ru/clck/jsredir?from=yandex.ru%3Bsearch%2Ftouch%2F%3Bweb%3B%3B7000700&text=&etext=1904.h52Fo2ZnC3FOkHkNNBYSHizFzXCfgCrwLJV1CGSc7622IRqRA1swNKB-jJEzg6055Rqqh8lGWF3PxDavHSr8yqWq1aFt1Xj5PKSivJu5yOU.e71d01f696bc6198159f8de94ba7cb5e5269452d&uuid=7f432958c35823a4758bd8aad63c2fba&state=mRoBCrXWMe34tQ-6cFtezrVV-Rj_S6iYGcclC4n2Jyo_ximX8jugTYNdFrSNp67zC8aRm-DeSqVDyGeCkS6rsK7-rYlIfkZ9hWpn7OUxXStKLefUm1MozGW2tJVsNLgAbANz-Vx0Mz2dFHRtiltJXHE6XmEHTxIc&&cst=K0nm9ELKENqmtDdqS0LHtfl2UzEyRC4p3svABbiODRfWTFpUggj8Iue2zzlQ8UXpmXj6QPOHkIljIKD3EMnA6YdrSKAH3MhCInLw160bKqLye1XMB4-_dCiGK_wUOYt1Zq06EU-XWwXHCrZC6qpXJTZlQ2_1GbfTc7UWcbPhVtdfAlLtSEaDFGJZga1x-FqaILkemHRLtensdpUjcmrJ4Jg3MIJnrYY4o6xOoTV6nySd-vV217RPtnRwMF4ljF1WYsxu2qO3jBreBxEh9ffSGOAfkiYh4Z3Dhz9ETqNZ7yvAIl_922AmB4pCzhq3CSCt6Q3iLonXmT1ajXjiQ_PKmgQ9uZUrJyC8tHVM0FJ7b3MLVLfQrn4nRMoky9Z7lx0aGlS3IBIVgsCkSEn_swD8p-gPR1JOl1fwS25OPQVj4GfPuERjJ_8Or9kQ8NKQKEWCblQwHc_P1kVAOco90gSyoZJCN3EU7YP1JiUBExctbUVkmO5y373UXx88AJnKsHGqiM-eW53LAeqs48b8VRKk_3Occg0mSS-3TEZGci_hdce5fq3uLW-K2HleNsSdKqHTJ2CdXt_JPee-K3LW4WQ0DUJH6jXJfULBIL8gTkCLbnLeRc_wRmGJYPik1nIU9WyI3PGDX4I9luh6FcWkq0gPgmLwMUyT0VAldekDndoOh-jR5tCsM0YwhzTjh0O3MeI_U3vL7HgVSxJsoZ4EChWQDx_l-2-g9W36klfLcpjt2iPEOIk99YMf9fcnJ78-DBX7xPI4A3AR-O6QE46tKkVkpVg_aw_K6ntVJ9OhoqMZOHVQL3BFg6bLPxfkYvH476xFLZ94A3vH-iTXwfA0v5HNxuDsTZWUh6A9PMI6sTzj8FNRvWSaXnLsZzHNHjUKNuQlrrqUxb-z7M1-pBT8ZgyFgGwHHceYgoD5RP2Ok_b-uKfD6UnUrYI-muWga-JJ7CU8uf9Ni01YVZg,&data=YXVyX05KbjR2dUdWUTVLcFhDTDVDb25HQjg3UkRaT2Y0cU9ST1djUGl6b1hqdHdtLWs1bmFkUC1GRkc2QTB5N3hmVERUS19UbDBQcmNFamJYNjhUYjZpT3dIR0FWaHExbU5ZakVSeUhiUnp2LUlnSVFDQ19qRVNYZTk5RVFMNFktZ2tZT0lsTmFVbyw,&sign=4e82c0ff9aa8f304d87a06812465536b&keyno=13&b64e=2&ref=JlJXPk4VfDHfhITz4Dod4RR4QJhFvfJMxAQKkNs1U-zY8AsHIl3Sap9_zGvQPKfJt_rvXDqewjku_toB43M3IO-hUqBnUkXN6T4b0YqBwgYlNQdfPRBT3Ujeb5XddCqxvYpkc63_5lAEy4ci80QGxsC_Q6lZxZqP2NApn3NfEx1SqErwQi_x6aqDEUfACrhmfzAUDv0ApGWJg61k1cvguC-0TjciLYFYFaOB9t7GH_pKt9SLJqQ_P0AgdnRSQSpubvYRgMLHJPGL2GxsICxmv9-ham6Dl1unqncLU_kZltdv1blbuEukiG_6yMGE8BMisu-yyogdCXCgBPQ1G7yXhkBqgCi3KwheFrsmi6b4hYggE6MQXa-FJsSQEuoh58-5GNOm6yY-dk4EVNXHb9AJ7WwukinRpWldBH9hFvFxunQ2kOG9TnkHprQuW5jjvxecMJKbT9rj8-gLJsnV-8LMuh4wEDIIUIRdrqvTDrZLM87s3eJkJeqTs96rfsrLbCG5vD3Z4OJO3-0qRwiS3jwIgXvNMnBwwqVSvAkFps0VfVZWlNqKOGXe9zBU29nrG0MhsObD88eC0PeZ3Llr03fBAHOANgVwHUPsejDncjrV5u9LNPFUn7qxMYV9NC0yleR4v4UsG9RJJi7nePzjDev7LEJu0RdFFY437AZ1H63AhnyHaXhoH-rcXooUaXjn-ogGmrl0KGgXfUj_U-mek1LZ721WiOssxXhBsKFrqG979WrBdp65BCS_xewixeal6NOGpiFc-I2on4M,&l10n=ru
[Sat Sep 08 19:44:09.497537 2018] [:error] [pid 9265] [client 85.140.77.16:20198] script '/var/www/html/pesenki_detskie.php' not found or unable to stat
[Sat Sep 08 19:46:15.956278 2018] [:error] [pid 9480] [client 85.140.23.143:58313] script '/var/www/html/russian.php' not found or unable to stat, referer: https://yandex.ru/
[Sat Sep 08 19:46:24.439655 2018] [:error] [pid 7121] [client 85.140.23.143:53908] script '/var/www/html/russian.php' not found or unable to stat, referer: https://yandex.ru/
[Sat Sep 08 20:00:18.621470 2018] [:error] [pid 9480] [client 31.193.90.131:21215] script '/var/www/html/proxy.php' not found or unable to stat, referer: RefererString
[Sat Sep 08 20:08:33.693396 2018] [:error] [pid 9397] [client 31.193.90.131:57933] script '/var/www/html/proxy.php' not found or unable to stat, referer: RefererString
[Sat Sep 08 20:23:11.265241 2018] [:error] [pid 10066] [client 31.193.90.131:53443] script '/var/www/html/proxy.php' not found or unable to stat, referer: RefererString
[Sat Sep 08 20:29:53.610498 2018] [:error] [pid 9397] [client 88.147.153.89:16198] script '/var/www/html/skazki-pushkin.php' not found or unable to stat, referer: https://yandex.ru/
[Sat Sep 08 20:33:44.053097 2018] [:error] [pid 13358] [client 31.193.90.131:61962] script '/var/www/html/proxy.php' not found or unable to stat, referer: RefererString
[Sat Sep 08 20:49:54.124547 2018] [core:notice] [pid 1869] AH00052: child pid 10913 exit signal Segmentation fault (11)
[Sat Sep 08 20:49:54.124606 2018] [mpm_prefork:notice] [pid 1869] AH00169: caught SIGTERM, shutting down
[Mon Sep 10 05:44:37.406309 2018] [mpm_prefork:notice] [pid 20651] AH00163: Apache/2.4.25 (Debian) OpenSSL/1.0.2l mod_perl/2.0.10 Perl/v5.24.1 configured -- resuming normal operations
[Mon Sep 10 05:44:37.406355 2018] [core:notice] [pid 20651] AH00094: Command line: '/usr/sbin/apache2'
[Mon Sep 10 05:45:18.617291 2018] [:error] [pid 20670] [client 85.140.18.72:33838] script '/var/www/html/pesenki.php' not found or unable to stat, referer: https://r.search.yahoo.com/_ylt=AwrJQ5y_55Vb8U4ANIGBuhc5;_ylu=X3oDMTBydWZibG83BGNvbG8DaXIyBHBvcwM4BHZ0aWQDBHNlYwNzcg--/RV=2/RE=1536579647/RO=10/RU=http%3a%2f%2fnarodstory.net%2fpesenki.php/RK=2/RS=3DW56PLAUomyGzrD0bIyiDJB4no-
[Mon Sep 10 05:45:44.852070 2018] [:error] [pid 20659] [client 85.140.18.145:62937] script '/var/www/html/pesenki.php' not found or unable to stat, referer: http://www.google.com/
[Mon Sep 10 05:45:56.959357 2018] [:error] [pid 20662] [client 85.140.17.216:21272] script '/var/www/html/marshak-stichi.php' not found or unable to stat, referer: http://clck.yandex.ru/jsredir?from=yandex.ru%3Bsearchapi%3Bsearchapp%3Bwp%3B400%3B1536551144162228-957502-sas1-0420-SAPI%3B1536551144162228-957502-sas1-0420-SAPI&text=%D0%B4%D0%B2%D0%B5%D0%BD%D0%B0%D0%B4%D1%86%D0%B0%D1%82%D1%8C%20%D0%BC%D0%B5%D1%81%D1%8F%D1%86%D0%B5%D0%B2%20%D1%87%D0%B8%D1%82%D0%B0%D1%82%D1%8C%20&uuid=0cfdd418c72233438c0035f5174a381c&state=AiuY0DBWFJ4ePaEse6rgeCPM-MH1jM4y64AgvS4JXu9RN6SbEqy-I1omOGp4lBsddHY2NsB6McF5SFfzfCE2KQ9OwqEjKwWX7-R6SZf_PUgk0oFDSqrQgHkwYk_ioIb7iFpl9hvnt7d-8zHs_kw9kjU9f-Uvc6ilCS8vsO0oNhdij1va_Ccu1M-8OQaT6UGUHlY8BPsZkKZSsB7-nfho7uYGvlLtGWXWN84VlCxH2d82SSCy_jxYk1MYOqaNKRXQj7wZ_P_LLk_BZaL4xrPnjVH_nxktEwxCkGjGlnagQSye7DRu8sw0VaXhnj0MJW4EshPWnmXFWrY&data=UlNrNmk5WktYejR0eWJFYk1LdmtxbERzMEdsdWR4dlJyNlRndTQxbVc5MnZ4Qm9HVFRfSGFUZ3hnTExwZVZkNlV6a01uXzZDRWJ4S2gwR3FOcGdyTUFaX05CaWtRSUpmQkE2bXdIWWd5b1U&b64e=2&sign=0b498cea8159b6ab30d95f12b58439a0&keyno=0
[Mon Sep 10 05:46:01.667932 2018] [:error] [pid 20662] [client 85.140.17.216:21272] script '/var/www/html/marshak-stichi.php' not found or unable to stat
[Mon Sep 10 05:46:43.907102 2018] [:error] [pid 20671] [client 178.72.69.6:2114] script '/var/www/html/mif-drevney-grecii.php' not found or unable to stat, referer: https://yandex.ru/
[Mon Sep 10 05:52:04.420545 2018] [:error] [pid 20657] [client 31.193.90.131:40939] script '/var/www/html/proxy.php' not found or unable to stat, referer: RefererString

Sieht fast wie ein Angriff eines Scriptkiddies aus? Aber dass man Apache so "ausknipsen" kann wäre böse

Weiß jemand, ob man etwas gegen solchen Unsinn machen kann?

[DeletedUserReAsG]

Es probiert einfach einige möglicherweise vorhandene, angreifbare Scripte durch. Apache sollte™ sich davon nicht aus dem Takt bringen lassen. Wenn es öfter segfaulted, vielleicht mal Loglevel auf debug stellen, und ggf. einen Bugreport aufmachen (bzw. gucken, ob es schon einen gibt).

[weshalb]

Kann man das nicht mit Fail2ban abstellen?

Zudem vielleicht auch mal über GEOIP nachdenken, sofern russische/ukrainische Ip's nicht zu deinen Usern passen sollten.

[Exxter]

Guten Morgen,

geoip und iptables, die Idee ist gut. Habe das mal nach diesem Tutorial:

https://documentacoes.wordpress.com/201 ... -debian-9/

eingerichtet. Dann habe ich:

iptables -I INPUT -m geoip --src-cc CN,UA,TW,RU -j DROP

gesetzt und iptables -L zeigt die Regel auch an erster Stelle an:

Code: Alles auswählen

Chain INPUT (policy DROP)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere             -m geoip --source-country CN,UA,TW,RU

Code: Alles auswählen

root@server /tmp # lsmod|grep geo
xt_geoip               16384  2
x_tables               36864  11 xt_LOG,xt_multiport,ipt_REJECT,xt_geoip,ip_tables,ebtables,iptable_filter,xt_tcpudp,ip6table_filter,xt_conntrack,ip6_tables
root@server /tmp #

Doch die Anfragen aus RU kommen immer noch. Jemand eine Idee warum?