Httpd访问日志充满了来自localhost的暴力攻击

Question

最后几周，我有更多的传入而不是传出流量，当我查看访问日志时，我每小时收到超过100,000个这些请求。因为ip-address来自localhost，所以我不知道如何阻止这种攻击。

127.0.0.1 - - [26/Mar/2015:21:29:15 +0100] "POST /wp-login.php HTTP/1.0" 404 571
127.0.0.1 - - [26/Mar/2015:21:29:15 +0100] "POST /wp-login.php HTTP/1.0" 404 573
127.0.0.1 - - [26/Mar/2015:21:29:15 +0100] "POST /wp-login.php HTTP/1.0" 404 577
127.0.0.1 - - [26/Mar/2015:21:29:15 +0100] "POST /wp-login.php HTTP/1.0" 404 559
127.0.0.1 - - [26/Mar/2015:21:29:15 +0100] "POST /wp-login.php HTTP/1.0" 404 571
127.0.0.1 - - [26/Mar/2015:21:29:15 +0100] "POST /wp-login.php HTTP/1.0" 404 570
127.0.0.1 - - [26/Mar/2015:21:29:15 +0100] "POST /wp-login.php HTTP/1.0" 404 572

Answer 1

您是否尝试过识别发送这些请求的进程名称？检查tcpdump以获取数据包的源端口号。然后运行sudo netstat -a -u -n --program。查找与源端口号匹配的PID /程序名称。然后你应该确定这个程序是否合法并以你期望的方式行事。