Я ищу некоторых, чтобы выяснить, почему на нашем сервере возникла эта проблема.
Мы получили уведомление от нашего сервера о том, что наш сервер выдавал необычную сетевую активность. Я пытался копаться в журналах, но ничего не получил.
У нас был пользователь WP, у которого в public_html была куча похищенных файлов. Я прошел и удалил все эти файлы и провел проверку безопасности.
Вот некоторые из журналов от поставщика сервера:
[Wed Apr 25 17:19:59.239790 2018] [:error] [pid 14971:tid
140081856567040] [client 212.48.71.168:37282] [client 212.48.71.168]
ModSecurity: Access denied with code 406 (phase 2). Operator GT matched
0
at USER:bf_block. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"]
[line "13"] [id "10014"] [msg "ip address blocked for 15 minutes, more
than
10 login attempts in 3 minutes."] [hostname "tyler.provick.ca"] [uri
"/wp-
login.php"] [unique_id "WuD-DaXgQ8dmu2ilwH6qhAAAAAE"]
[Wed Apr 25 17:20:05.749244 2018] [:error] [pid 23881:tid
140081846077184]
[client 212.48.71.168:37994] [client 212.48.71.168] ModSecurity: Access
denied with code 406 (phase 2). Operator GT matched 0 at USER:bf_block.
[file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "13"] [id
"10014"] [msg "ip address blocked for 15 minutes, more than 10 login
attempts in 3 minutes."] [hostname "tyler.provick.ca"] [uri "/wp-
login.php"] [unique_id "WuD-FWAM7JcmpgzC2BGdCAAAAMI"]
Я пробовал такие вещи, как:
[root@pluto ~]# grep ModSecurity /usr/local/apache/logs/error_log | sed
-e 's#^.*\[id "\([0-9]*\).*hostname "\([a-z0-9\-\_\.]*\)"\].*uri "#\1
\2 #' | cut -d\" -f1 | sort -n | uniq -c | sort –n
sort: cannot read: –n: No such file or directory
[root@pluto ~]# grep -i modsec /usr/local/apache/logs/error_log | grep
clientexec | grep 2014 | sed "s/$/\\n/"
И обновил Кернал:
[root@pluto ~]# yum -y update kernel
Сервер является Centos 7, с Cloud Linux, Cagefs и cPanel и т. Д.
[root @ pluto ~] # tail / usr / local / apache / logs / access_log
::1 - - [27/Apr/2018:10:59:43 +0100] "OPTIONS * HTTP/1.0" 200 - "-"
"Apache/2.4.33 (cPanel) OpenSSL/1.0.2o mod_bwlimited/1.4
Phusion_Passenger/5.1.8 (internal dummy connection)"
::1 - - [27/Apr/2018:10:59:50 +0100] "OPTIONS * HTTP/1.0" 200 - "-"
"Apache/2.4.33 (cPanel) OpenSSL/1.0.2o mod_bwlimited/1.4
Phusion_Passenger/5.1.8 (internal dummy connection)"
::1 - - [27/Apr/2018:10:59:57 +0100] "OPTIONS * HTTP/1.0" 200 - "-"
"Apache/2.4.33 (cPanel) OpenSSL/1.0.2o mod_bwlimited/1.4
Phusion_Passenger/5.1.8 (internal dummy connection)"
::1 - - [27/Apr/2018:10:59:58 +0100] "OPTIONS * HTTP/1.0" 200 - "-"
"Apache/2.4.33 (cPanel) OpenSSL/1.0.2o mod_bwlimited/1.4
Phusion_Passenger/5.1.8 (internal dummy connection)"
::1 - - [27/Apr/2018:10:59:59 +0100] "OPTIONS * HTTP/1.0" 200 - "-"
"Apache/2.4.33 (cPanel) OpenSSL/1.0.2o mod_bwlimited/1.4
Phusion_Passenger/5.1.8 (internal dummy connection)"
::1 - - [27/Apr/2018:11:00:00 +0100] "OPTIONS * HTTP/1.0" 200 - "-"
"Apache/2.4.33 (cPanel) OpenSSL/1.0.2o mod_bwlimited/1.4
Phusion_Passenger/5.1.8 (internal dummy connection)"
127.0.0.1 - - [27/Apr/2018:11:00:01 +0100] "GET /whm-server-status
HTTP/1.0" 200 17088 "-" "-"
::1 - - [27/Apr/2018:11:00:01 +0100] "OPTIONS * HTTP/1.0" 200 - "-"
"Apache/2.4.33 (cPanel) OpenSSL/1.0.2o mod_bwlimited/1.4
Phusion_Passenger/5.1.8 (internal dummy connection)"
::1 - - [27/Apr/2018:11:00:03 +0100] "OPTIONS * HTTP/1.0" 200 - "-"
"Apache/2.4.33 (cPanel) OpenSSL/1.0.2o mod_bwlimited/1.4
Phusion_Passenger/5.1.8 (internal dummy connection)"
127.0.0.1 - - [27/Apr/2018:11:00:06 +0100] "GET / HTTP/1.0\n" 400 10072
"-" "-"