Is someone trying to Hack? Receiving Suspicious Requests on my Apache2 Ubuntu 18.04 server

Question

Today I was checking my server logs then I noticed some requests which I think is that someone is trying to get into my server. I am hosting PHP Laravel (6) based admin panel and API's on it. I have also checked my public routes and permissions of the files. Can someone figure out what else should I do to prevent something disastrous thing to happen? Thanks in advance.

Here are some other suspicious requests :

/hudson
/cgi-bin/mainfunction.cgi
/?XDEBUG_SESSION_START=phpstorm
/solr/admin/info/system?wt=json
/?-a=fetch&content=%3Cphp%3Edie%28%40md5%28HelloThinkCMF%29%29%3C%2Fphp%3E
/api/jsonws/invoke
/azenv.php?a=PSCMN&auth=159175997367&i=2650084793&p=80
?function=call_user_func_array&s=%2FIndex%2F%5Cthink%5Capp%2Finvokefunction&vars%5B0%5D=md5&vars%5B1%5D%5B0%5D=HelloThinkPHP
/.well-known/security.txt
/sitemap.xml
/TP/index.php
/TP/public/index.php
/ip.ws.126.net:443
/nmaplowercheck1591708572
/evox/about
/MAPI/API
/evox/about
/owa/auth/logon.aspx?url=https%3A%2F%2F1%2Fecp%2F
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

This question is far too broad for Stackoverflow. Whole books are written on the subject of hardening servers against attacks. — Quentin, Jun 10 '20 at 11:28
Maybe, Just happened to me for the first time. The thing for which I am looking for is a way that how can I prevent myself from being brute-forced by these kinds of scripts trying to find vulnerabilities in the system. — faizan.sh, Jun 10 '20 at 15:52
they are automated bots. my server receives many similar requests: - `/?XDEBUG_SESSION_START=phpstorm` - `/owa/auth/logon.aspx?url=https://1/ecp/` - `///3c625c27b4da33d3d5c12e8d02104755/js/login.js` - `/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession` if you check `/var/log/auth.log` it's much worse — bl3ssedc0de, Dec 18 '22 at 23:28

score 26 · Accepted Answer · answered Jun 13 '20 at 18:38

These are among many bots that are constantly trying to break into servers or gain unauthorized access on your web app. You can read more about them here. This happens to all servers, regardless of which service provider you're using AWS / DigitalOcean / Linode or whatever other options.

Most commonly, they'll try generic login urls and bruteforce them with default or common username/passwords. They're always there, but you probably did not notice until you started checking the log files.

While we're on this topic, there are also SSH worms that are constantly trying to bruteforce SSH into your server. This is why it's important to use good passwords, or better yet, disable password entry into your server and only allow SSH. That will greatly improve security but still will not stop their efforts.

What you can do to protect your server:

Like mentioned above, disabled password login and only allow SSH
Enable firewall and setup the firewall rules accordingly
Ensure the packages that you use always have the latest security patches
Use tools like Fail2Ban which will ban an IP if SSH attempts failed more than a set amount of time. You can configure Fail2Ban to do more, do explore the docs

changing the ssh port for something else than 22 is also a good security mesure — Lk77, May 17 '22 at 09:09
chaning from ssh password authention to ssh-key-based is an even better measure. — Henrique de Sousa, Dec 20 '22 at 12:08

score 0 · Answer 2 · answered Jun 10 '20 at 16:14

Welcome to the internet.

The last time I bothered to look it took around 10 minutes after plugging a device into a public IP address which had been unused for over 6 months before the first attack. What you can do about it is:

Ensure you keep your OS and any third party libs/applications are patched and up to date
Ensure that the uid running your PHP code can only write to specific locations outside the document root (preferable nowhere on the filesystem)
Ensure that the uid running your PHP code cannot read your weblogs
write secure code
Take regular backups
Run a host based IDS

score -1 · Answer 3 · answered Jun 10 '20 at 08:41

-1

This might just be an automated bot searching for certain files/urls on the webserver. Make sure all your environment files are not accessible (using htaccess) and you have the latest security patches of Laravel.

answered Jun 10 '20 at 08:41

mugai

31
2

But i was thinking that why a bot will try to download and run a file by trying to inject a shell script. – faizan.sh Jun 10 '20 at 08:45
Well maybe they're not trying to run/download it but there is something they're trying. I'm not sure what this could be – mugai Jun 10 '20 at 08:48
1

This is not a bot looking for files; it's a remote file inclusion attempt. – symcbean Jun 10 '20 at 16:15

Is someone trying to Hack? Receiving Suspicious Requests on my Apache2 Ubuntu 18.04 server

3 Answers3