设为首页收藏本站

简体中文 繁體中文 English 日本語 Deutsch 한국 사람 بالعربية TÜRKÇE português คนไทย french

搜索
热搜: 活动 交友 discuz
Discuz! Board»论坛 › 主机综合交流 › 美国VPS综合讨论 › 服务器被大规模wp
123下一页
返回列表 发新帖

服务器被大规模wp [复制链接]
查看:199 | 回复:24

xuebook

32

主题

107

回帖

360

积分

中级会员

积分
360
发表于 2013-4-11 14:39:30 | 显示全部楼层 |阅读模式
服务器上很多安装wordpress的，有人利用工具暴力破解wp-login.php，ip段一直封不停，怎么办？
回复

举报

404

39

主题

1164

回帖

2507

积分

金牌会员

积分
2507
发表于 2013-4-11 14:40:11 | 显示全部楼层
文件临时改个名.....哪个IP访问原来的地址就扔iptables屏掉.....
回复

举报

李院长

64

主题

3106

回帖

6530

积分

论坛元老

积分
6530
发表于 2013-4-11 14:42:09 | 显示全部楼层
龙少？
回复

举报

thymol

263

主题

378

回帖

1573

积分

金牌会员

积分
1573
发表于 2013-4-11 14:42:56 | 显示全部楼层
你又不会被爆 让他们扫
回复

举报

大胡子

553

主题

5140

回帖

1万

积分

论坛元老

积分
12025
发表于 2013-4-11 14:43:01 | 显示全部楼层

thymol 发表于 2013-4-11 14:42



把登陆地址临时做个301到127.0.0.1……
把wp-admin改成死循环
回复

举报

大胡子

553

主题

5140

回帖

1万

积分

论坛元老

积分
12025
发表于 2013-4-11 14:44:06 | 显示全部楼层
删除不登录了
回复

举报

thymol

263

主题

378

回帖

1573

积分

金牌会员

积分
1573
发表于 2013-4-11 14:42:00 | 显示全部楼层
关键是有很多个wordpress呢，暴力破解的也有很多个ip段的
回复

举报

paopao00

198

主题

4476

回帖

9622

积分

论坛元老

积分
9622
发表于 2013-4-11 14:46:02 | 显示全部楼层

thymol 发表于 2013-4-11 14:46



我的dede后台死循环还没好………你那天说解决方法说了一半………
哪个帖子难道今天是个什么好日子？我也遇到一些主机用户这个问题
201.27.146.111 - - [11/Apr/2013:14:58:34 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"
201.27.146.111 - - [11/Apr/2013:14:58:36 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (Windows; U; MSIE 9.0; WIndows NT 9.0; en-US))"
201.27.146.111 - - [11/Apr/2013:14:58:36 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"
201.27.146.111 - - [11/Apr/2013:14:58:39 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (Windows NT 6.1; rv:15.0) Gecko/20120716 Firefox/15.0a2"
201.27.146.111 - - [11/Apr/2013:14:58:38 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (Windows NT 6.1; rv:15.0) Gecko/20120716 Firefox/15.0a2"
201.27.146.111 - - [11/Apr/2013:14:58:39 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (Windows; U; MSIE 9.0; WIndows NT 9.0; en-US))"
201.27.146.111 - - [11/Apr/2013:14:58:39 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)"
201.27.146.111 - - [11/Apr/2013:14:58:41 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 7.1; Trident/5.0)"
201.27.146.111 - - [11/Apr/2013:14:58:41 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 7.1; Trident/5.0)"
201.27.146.111 - - [11/Apr/2013:14:58:42 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (Windows NT 6.1; rv:15.0) Gecko/20120716 Firefox/15.0a2"
201.27.146.111 - - [11/Apr/2013:14:58:43 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"
201.27.146.111 - - [11/Apr/2013:14:58:44 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1309.0 Safari/537.17"
201.27.146.111 - - [11/Apr/2013:14:58:45 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (Windows NT 6.1; rv:15.0) Gecko/20120716 Firefox/15.0a2"
201.27.146.111 - - [11/Apr/2013:14:58:47 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (Windows NT 6.1; rv:15.0) Gecko/20120716 Firefox/15.0a2"
201.27.146.111 - - [11/Apr/2013:14:58:47 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (Windows NT 6.1; rv:15.0) Gecko/20120716 Firefox/15.0a2"
201.27.146.111 - - [11/Apr/2013:14:58:48 +0800] "POST /wp-login.php HTTP/1.1" 200 13640 "-" "Mozilla/5.0 (Windows NT 6.1; rv:15.0) Gecko/20120716 Firefox/15.0a2"

像这些。
93.184.224.3 - - [11/Apr/2013:14:36:12 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)"
93.184.224.3 - - [11/Apr/2013:14:36:12 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/6.0 (Windows NT 6.2; WOW64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"
93.184.224.3 - - [11/Apr/2013:14:36:12 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/6.0 (Windows NT 6.2; WOW64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"
93.184.224.3 - - [11/Apr/2013:14:36:12 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/6.0 (Windows NT 6.2; WOW64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"
93.184.224.3 - - [11/Apr/2013:14:36:12 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/6.0 (Windows NT 6.2; WOW64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"
93.184.224.3 - - [11/Apr/2013:14:36:12 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/6.0 (Windows NT 6.2; WOW64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"
93.184.224.3 - - [11/Apr/2013:14:36:12 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)"
93.184.224.3 - - [11/Apr/2013:14:36:13 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)"
93.184.224.3 - - [11/Apr/2013:14:36:13 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)"
93.184.224.3 - - [11/Apr/2013:14:36:13 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 7.1; Trident/5.0)"
93.184.224.3 - - [11/Apr/2013:14:36:13 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/6.0 (Windows NT 6.2; WOW64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"
93.184.224.3 - - [11/Apr/2013:14:36:13 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/6.0 (Windows NT 6.2; WOW64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"
93.184.224.3 - - [11/Apr/2013:14:36:13 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)"
93.184.224.3 - - [11/Apr/2013:14:36:13 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1309.0 Safari/537.17"
93.184.224.3 - - [11/Apr/2013:14:36:13 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/5.0 (Windows NT 6.1; rv:15.0) Gecko/20120716 Firefox/15.0a2"
93.184.224.3 - - [11/Apr/2013:14:36:13 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/6.0 (Windows NT 6.2; WOW64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"
93.184.224.3 - - [11/Apr/2013:14:36:13 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1309.0 Safari/537.17"
93.184.224.3 - - [11/Apr/2013:14:36:13 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/6.0 (Windows NT 6.2; WOW64; rv:16.0.1) Gecko/20121011 Firefox/16.0.1"
93.184.224.3 - - [11/Apr/2013:14:36:13 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)"
93.184.224.3 - - [11/Apr/2013:14:36:13 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)"
93.184.224.3 - - [11/Apr/2013:14:36:13 +0800] "POST /wp-login.php HTTP/1.1" 302 233 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)"


不过，建议装个Limit Login Attempts
回复

举报

xuebook

32

主题

107

回帖

360

积分

中级会员

积分
360
 楼主| 发表于 2013-4-11 14:46:38 | 显示全部楼层
应该可以自动分析log
1.对wp-login.php扫号的，一般只有POST记录，而正常登录一般先有个GET记录，然后再POST
2.登陆成功之后返回的是302跳转，登陆失败的则是200返回当前页面。注意登陆时是POST，而打开登陆页虽然也返回200，但却是GET。

以上只是思路，我没试过。针对第1条我不知道怎么实现，对第2条我想可以用fail2ban设置。
回复

举报

QuaintJade

41

主题

305

回帖

773

积分

高级会员

积分
773
发表于 2013-4-11 14:46:58 | 显示全部楼层

404 发表于 2013-4-11 14:40



文件临时改个名.....哪个IP访问原来的地址就扔iptables屏掉.....

有人说301到127。。。

照理说，应该也可以301到cachefly那个100mb的文件。。。
回复

举报

123下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 立即注册

论坛客服/商务合作/投诉举报:2171544 (QQ)
落伍者创建于2001/03/14,本站内容均为会员发表,并不代表落伍立场!
拒绝任何人以任何形式在本论坛发表与中华人民共和国法律相抵触的言论!
落伍官方微信：2030286 邮箱：(djfsys@gmail.com|tech@im286.com)
© 2001-2014

浙公网安备 33060302000191号

浙ICP备11034705号 BBS专项电子公告通信管[2010]226号
　 落伍法律顾问: ITlaw-庄毅雄

Archiver|手机版|Discuz! X

GMT+8, 2026-7-26 02:11 , Processed in 0.025431 second(s), 3 queries , Gzip On, Redis On.

返回顶部