Website Security

[mr_bo]

I am running an ispc 3/Centos server and all is well except for Awstats on one of the domains is logging hits on:

/webmail/src/left_main.php
/webmail/src/right_main.php
/webmail/src/login.php
/webmail/src/webmail.php
/webmail/src/read_body.php
/webmail/src/compose.php

There is only 2 email accounts on this domain for which both have imap disabled and passwords have been changed, robots.txt is also covering these but still receiving 140 hits in 3 days!

Another domin is logging hits on:

/mysqladmin/scripts/setup.php
/phpmyadmin/scripts/setup.php
/phpMyAdmin/scripts/setup.php

Am I being targeted? Am I safe or should I be worried?

Thanks in advance.

[falko]

You should keep an eye on it. If all hits come from the same IP, and this IP doesn't belong to any of your customers, you can block the IP.

[mr_bo]

Originally Posted by falko

You should keep an eye on it. If all hits come from the same IP, and this IP doesn't belong to any of your customers, you can block the IP.

How do you block them?

And is this a good step to take? Given the centos firewall is off and the ispc firewall is on.

[till]

http://www.faqforge.com/linux/how-to...ress-on-linux/

[mr_bo]

/sbin/route add -host 192.168.0.123 reject

Ok, I just used this command on an ip.... a wrong ip Can it be reversed?

[falko]

Try

/sbin/route del -host 192.168.0.123 reject

or reboot the system.

[mr_bo]

Thanks, the help you guys give here is invaluable