0

I am seeing a lot of requests where users are trying to request PhPMyAdmin directory on my web-server and I would like to put an end to it. They try a few different directories like PhpMyAdmin-2.10 or just PhpMyAdmin or just PhpMyAdmin-2.09

Would Apache Re-write rule be the best thing to re0direct them to a blackhole that bans their IP from accessing the IP again?

Or

I could simply create these directories and put in a javascript redirect to black-hole them as well.

Thoughts on a good solution are appreciated.

EDIT: Here is what I am doing in .htaccess

RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_URI} ^/phpmyadmin [NC,OR]
RewriteCond %{REQUEST_URI} ^/admin [NC,OR]
RewriteCond %{REQUEST_URI} ^/dbadmin [NC,OR]
RewriteCond %{REQUEST_URI} ^/mail [NC,OR]
RewriteCond %{REQUEST_URI} ^/myadmin [NC,OR]
RewriteCond %{REQUEST_URI} ^/mysql [NC,OR]
RewriteCond %{REQUEST_URI} ^/php\-my\-admin [NC,OR]
RewriteCond %{REQUEST_URI} ^/pma [NC,OR]
RewriteCond %{REQUEST_URI} ^/webmail [NC]
RewriteRule .* http://%{REMOTE_ADDR}%{REQUEST_URI} [R=301]
AXL
  • 3

2 Answers2

3

You could waste their time - which may do more to prevent them from scanning the internet as a whole than banning their IP would:

RewriteEngine on
RewriteBase /
RewriteCond %{REQUEST_URI} ^/phpmyadmin [NC]
RewriteRule .* http://%{REMOTE_ADDR}%{REQUEST_URI} [R=301]

Update: To add directories or files you can add additional conditions (be careful not to block search spiders, etc)...

Update x2: Added the Last and QueryStringAppend flags, commented desirable location for additional rules.

RewriteEngine on

RewriteBase /

RewriteCond %{REQUEST_URI} ^/phpmyadmin [NC,OR]
RewriteCond %{REQUEST_URI} ^/admin [NC,OR]
RewriteCond %{REQUEST_URI} ^/dbadmin [NC,OR]
RewriteCond %{REQUEST_URI} ^/mail [NC,OR]
RewriteCond %{REQUEST_URI} ^/myadmin [NC,OR]
RewriteCond %{REQUEST_URI} ^/mysql [NC,OR]
RewriteCond %{REQUEST_URI} ^/php\-my\-admin [NC,OR]
RewriteCond %{REQUEST_URI} ^/pma [NC,OR]
RewriteCond %{REQUEST_URI} ^/webmail [NC]
RewriteRule .* http://%{REMOTE_ADDR}%{REQUEST_URI} [L,R=301,QSA]

#
# any other rewrite conditions and rules here
#
danlefree
  • 2,973
1

ModSecurity or fail2ban is what my research led me to.

There is also this question: How to thwart PHPMyAdmin attacks?

Community
  • 1
wrmine
  • 367