By murph on

Wasn't sure which forum to put this under so here goes anyway...

I have been getting alot of error messages from anon users since i installed drupal on a certain domain. This domain isn't listed in GG (or others) of has it ever been. It is a standard install, with no pages as yet other than the frontpage and no users (and no ability for surfers to add their own account). Just some of the error messages (listed in admin) coming from access attempts from a range of IPs are listed below:

NULL.printer not found.
hpgroupware/xmlrpc.php not found.
drupal/xmlrpc.php not found.
cgi-bin/awstats/awstats.pl not found.
xmlsrv/xmlrpc.php not found.
xmlrpc/xmlrpc.php not found.
403.shtml not found.
phpMyAdmin-2.5.4/main.php not found.
web/phpMyAdmin/main.php not found.
dbadmin/main.php not found.
mysql/main.php not found.
phpmyadmin/main.php not found.
wordpress/xmlrpc.php not found.
phpgroupware/xmlrpc.php not found.
blogs/xmlsrv/xmlrpc.php not found.
admin/pma/main.php denied access.

The list goes on...

Are these attempts at hacking my site in some way? In which case what permissions should i have set to make sure no-one can do any damage? I can obviously block their IPs if necessary, but what else should i do?

Should i be worried?

TIA

⋅ Categories: Drupal 4.6.x

Comments

heine’s picture

heine commented

Yes, probably a worm trying among others the XMLRPC vulnerability.

Make sure you use the latest versions of the applications or make sure they are inaccessible.

Drupal 4.6.5 is safe for this xmlrpc attack

edit: no you don't have an immediate reason to worry.
--
Tips for posting to the forums.
When your problem is solved, please post a follow-up to the thread you started.

murph’s picture

murph commented

I am using drupal version 4.6.5 installed beginning of this year.

What are the best permissions to use? At the moment i am using 775 for folders and 664 for files. The chown is set to the ftp user and the chgrp to apache. Is this safe for these attacks?

pedrofaria’s picture

pedrofaria commented

Yeah... be happy... :)

Some days ago someone made a trackback spam... but with spam module this problems was solved!

cya

--
Pedro Faria de Mirando Pinto
http://www.phpavancado.net - DevBlog (pt_BR)
irc://irc.brasnet.org/PHPAvancado - IRC Help channel (pt_BR / en)

mwu’s picture

mwu commented

I am seeing these messages also (only on site5, not on opensourcehost).
is there a way to block the worm, so that it doesn't fill up the watchdog logs and make it hard to find what we are looking for?