0

I have a LAMP configured server and multiple times from the Apache error log file I can see warning messages like this one:

[Thu Jul 02 08:54:04.263981 2015] [:error] [pid 12059] [client 5.45.79.44:49144] script '/var/www/html/wp-update.php' not found or unable to stat, referer: http://example.org/wp-update.php

Currently I have mod_security and inside Wordpress Wordfence enabled.

What should be done in such cases to protect and prevent from these attacks?

NineCattoRules
  • 2,253
  • 6
  • 39
  • 84

1 Answers1

1

Those warning messages can be ignored, since they are generated when Apache can't find the requested file (404) or permission to the requested file is denied (403).

I see tons of such messages daily in my server logs and the reason they appear is, that some automated scripts try to check your server for vulnerable/insecure scripts, that the admin may have forgotten. Lately I even noticed, that those kind of mass-requests even target SSH keys (GET /var/www/.ssh/id_rsa - just in case the server admin really misconfigured the server).

Running mod_security on your server with a tight ruleset (e.g. OWASP CRS) gives you a good basic protection against various kind of known/unknown attacks.

derhansen
  • 5,585
  • 1
  • 19
  • 29