error_log出现很多奇怪的File does not exist，被攻击了？

gavy41

帮忙看看下面的日志，好像ujqsweb.zip，joivpacket.mdb，lmgqshell.asp这些文件我们网站都是不可能有的，怎么会有这些访问记录呢？况且我配置是PHP+MYSQL的，像这样的日志还有很多，我怀疑是不是被攻击了

[Tue May 11 10:48:38 2010] [error] [client 218.71.193.192] File does not exist: /usr/local/apache2/www/zeo/ujqsweb.zip
[Tue May 11 10:48:39 2010] [error] [client 218.71.193.192] File does not exist: /usr/local/apache2/www/zeo/web.zip
[Tue May 11 10:48:39 2010] [error] [client 218.71.193.192] File does not exist: /usr/local/apache2/www/zeo/web.zip
[Tue May 11 10:48:39 2010] [error] [client 218.71.193.192] File does not exist: /usr/local/apache2/www/zeo/mapvwww.zip
[Tue May 11 10:48:39 2010] [error] [client 218.71.193.192] File does not exist: /usr/local/apache2/www/zeo/www.zip
[Tue May 11 10:48:39 2010] [error] [client 218.71.193.192] File does not exist: /usr/local/apache2/www/zeo/www.zip
[Tue May 11 10:48:40 2010] [error] [client 218.71.193.192] File does not exist: /usr/local/apache2/www/zeo/dyjbwwwroot.zip
[Tue May 11 10:48:40 2010] [error] [client 218.71.193.192] File does not exist: /usr/local/apache2/www/zeo/wwwroot.zip
[Tue May 11 10:48:40 2010] [error] [client 218.71.193.192] File does not exist: /usr/local/apache2/www/zeo/wwwroot.zip
[Tue May 11 10:49:24 2010] [error] [client 111.123.126.217] File does not exist: /usr/local/apache2/www/zeo/lmgqshell.asp
[Tue May 11 10:49:25 2010] [error] [client 111.123.126.217] File does not exist: /usr/local/apache2/www/zeo/cdnrweb.zip
[Tue May 11 10:49:26 2010] [error] [client 111.123.126.217] File does not exist: /usr/local/apache2/www/zeo/svgdwww.zip
[Tue May 11 10:49:27 2010] [error] [client 111.123.126.217] File does not exist: /usr/local/apache2/www/zeo/opyewwwroot.zip
[Tue May 11 10:49:28 2010] [error] [client 111.123.126.217] File does not exist: /usr/local/apache2/www/zeo/mjppHYTop.mdb
[Tue May 11 10:49:28 2010] [error] [client 111.123.126.217] File does not exist: /usr/local/apache2/www/zeo/joivpacket.mdb
[Tue May 11 10:49:28 2010] [error] [client 111.123.126.217] File does not exist: /usr/local/apache2/www/zeo/fylutomdb.mdb
[Tue May 11 10:49:28 2010] [error] [client 111.123.126.217] File does not exist: /usr/local/apache2/www/zeo/srydHSH.mdb

gavy41

我估计是攻击者在不断尝试服务器目录中可能存在的存放有敏感信息的文件，想禁止IP的，但发觉他们的IP是在不断改变，应该怎么做呢

liang3391

zip 扩展类型的文件不给访问。

gavy41

zip 扩展类型的文件不给访问。
liang3391 发表于 2010-05-13 15:39

这个只限制小小，对方主要是在扫描目录

0vk0

你看看他是在用哪个端口，看能不能禁用

gavy41

你看看他是在用哪个端口，看能不能禁用
0vk0 发表于 2010-05-14 07:40

我也想到这个方法，就是不知道怎么查出他是用哪个端口，对方用的是挖掘鸡