VPS abuse! Help!

Forums › IT Pro and developers › VPS abuse! Help!

WanderingNomad

2 posts

Wannabe Geek

#223200 19-Sep-2017 00:50

Long time reader, first time poster... hi all!

I have a VPS for hosting which I am having issues with an apache attack from a computer somewhere.

I understand the basics but I need someone's help to find the offending machine and fix the issue. The error I get is below, I have many like it. I have asked the host to check for viruses which they have and they cannot find any issue. I'm using a laptop myself which was off at the time of this error so I don't think it's me.

[Fri Sep 15 10:27:20.897763 2017] [:error] [pid 404] [client 96.127.170.15:41786] [client 96.127.170.15] ModSecurity: Access denied with code 406 (phase 2). Operator GT matched 0 at USER:bf_block. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "13"] [id "10014"] [msg "ip address blocked for 15 minutes, more than 3 login attempts in 3 minutes."] [hostname "secaccountants.com"] [uri "/wp-login.php"] [unique_id "WbvxWDGWhzE8Nx4NrTWnWQAAAF8"]

michaelmurfy

meow
13579 posts

Uber Geek
+1 received by user: 10910

Moderator

ID Verified

Trusted

Lifetime subscriber

#1868315 19-Sep-2017 06:54

That isn't an Apache attack - it is instead informing you it prevented a login to your Wordpress Admin portal.

Put the site behind Cloudflare (https://cloudflare.com).

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

ANglEAUT

altered-ego
2436 posts

Uber Geek
+1 received by user: 841

Trusted

Lifetime subscriber

#1868361 19-Sep-2017 08:33

Have to agree with michaelmurfy; start with Cloudflare or one of its competitors. Cloudflare do have a $0 plan for personal sites.

Your web site is using Wordpress. Looks like they are trying to find unpatched systems or ones with a default password. It is very unlikely that you will find the offending machine. Most likely they are zombie or bot nets doing the bidding of a master in the background.

Strengthen your security posture

Don't host your login page on port 80.
Keep WP patched & updated
Keep your server patched & updated
Decrease your threshold when you start to block a malicious attempt

Please keep this GZ community vibrant by contributing in a constructive & respectful manner.

timmmay

20858 posts

Uber Geek
+1 received by user: 5350

Trusted

Lifetime subscriber

#1868388 19-Sep-2017 09:09

Putting a site behind CloudFlare is only useful if you have a Firewall that prevents access from non-cloudflare IPs. Your serve IP hasn't changed and is otherwise still accessible.

That warning message isn't really a problem. I use fail2ban to add attacker IPs to the CloudFlare firewall, and there's no direct access to my IP. AWS is good like that, lots of control.

WanderingNomad

2 posts

Wannabe Geek

#1869884 21-Sep-2017 01:16

Thank you all for the replys. I will make changes as suggested and hope it's stays ok. Thanks