Apache-2.2
伺服器被洪水攻擊超載
我有一個強大的伺服器,有 64GB 記憶體和驚人的網路和 SSD 用於快速連接,但是有人,我不知道為什麼,正在攻擊我的網站,似乎它是一個經常請求我的 index.php 頁面的腳本導致我的MySQL不穩定,甚至我的伺服器使用了良好的硬體配置。檢查我的日誌文件:
[Fri Nov 06 13:02:47.169346 2020] [proxy_fcgi:error] [pid 30232:tid 140367357691648] [client 164.68.100.114:35336] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.169560 2020] [proxy_fcgi:error] [pid 29914:tid 140366971922176] [client 164.68.100.114:33102] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.170482 2020] [proxy_fcgi:error] [pid 29692:tid 140364547610368] [client 164.68.100.114:2658] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.168929 2020] [proxy_fcgi:error] [pid 30229:tid 140366980314880] [client 164.68.100.114:40178] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.169336 2020] [proxy_fcgi:error] [pid 30229:tid 140366946744064] [client 164.68.100.114:2841] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.186088 2020] [proxy_fcgi:error] [pid 30229:tid 140367483582208] [client 164.68.100.114:39838] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.186853 2020] [proxy_fcgi:error] [pid 30229:tid 140367089354496] [client 164.68.100.114:2591] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.187609 2020] [proxy_fcgi:error] [pid 30229:tid 140367097747200] [client 164.68.100.114:2609] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.188884 2020] [proxy_fcgi:error] [pid 30229:tid 140366837704448] [client 164.68.100.114:3360] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.190061 2020] [proxy_fcgi:error] [pid 30229:tid 140366946744064] [client 164.68.100.114:2841] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.190768 2020] [proxy_fcgi:error] [pid 30230:tid 140367475189504] [client 164.68.100.114:3624] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.190043 2020] [proxy_fcgi:error] [pid 30230:tid 140366611199744] [client 164.68.100.114:40394] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.190882 2020] [proxy_fcgi:error] [pid 30230:tid 140366468523776] [client 164.68.100.114:40390] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.190880 2020] [proxy_fcgi:error] [pid 30229:tid 140367114532608] [client 164.68.100.114:3085] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.190894 2020] [proxy_fcgi:error] [pid 29692:tid 140364556003072] [client 164.68.100.114:33944] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.190051 2020] [proxy_fcgi:error] [pid 30230:tid 140366544058112] [client 164.68.100.114:40392] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.190914 2020] [proxy_fcgi:error] [pid 30229:tid 140365092873984] [client 164.68.100.114:33844] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.188394 2020] [proxy_fcgi:error] [pid 30230:tid 140366493701888] [client 164.68.100.114:40396] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.191808 2020] [proxy_fcgi:error] [pid 30229:tid 140365076088576] [client 164.68.100.114:40402] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.190599 2020] [proxy_fcgi:error] [pid 30230:tid 140366560843520] [client 164.68.100.114:40386] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.190959 2020] [proxy_fcgi:error] [pid 30230:tid 140366577628928] [client 164.68.100.114:40388] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.192573 2020] [proxy_fcgi:error] [pid 30229:tid 140367466796800] [client 164.68.100.114:60224] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n' [Fri Nov 06 13:02:47.193573 2020] [proxy_fcgi:error] [pid 30229:tid 140366846097152] [client 164.68.100.114:60192] AH01071: Got error 'PHP message: PHP Warning: mysqli::__construct(): (08004/1040): Too many connections in /var/www/master/database.php on line 19\n'
我應該如何阻止這個?深入分析日誌,所有請求都是在 HEAD 方法上發出的。例如,如果我阻止對我的網站的 HEAD 請求,我會對 Google 機器人有任何問題或問題嗎?我不知道這是否是一個解決方案,似乎是一個技巧。另外,我正在使用 Cloudflare,這種攻擊仍然存在。我該怎麼辦?
謝謝你。
Fail2ban可能是一個不錯的選擇,可以在給定的時間段內觀察 apache 訪問日誌中是否存在異常數量的 HEAD 請求,並在 iptables 防火牆中創建一個臨時塊。
Jay Ta’ala在他的網站上有一篇文章,提供了有關如何配置 fail2ban 以查看 apache 日誌文件的資訊。