问题
I noticed something recently that has me a little concerned and at a loss for an explanation. Last week I spun up an EC2 instance running Ubuntu 14.04 to start working on a new Laravel app.
Today, I noticed it was taking an unusually long time to sync. I noticed that my sessions folder was close to 1 gig and my log file was over 300 Mb. The log file was full of Token Mismatch Exceptions. Does anybody have any ideas on why this is happening?
I should add that everything is working normally. I just checked my apache access log file and came up with a possible explanation.
80.82.65.206 - - [27/Sep/2015:10:33:25 +0000] "POST /xmlrpc.php HTTP/1.0" 500 14213 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; http://www.google.com/bot.html)"
80.82.65.206 - - [27/Sep/2015:10:33:26 +0000] "POST /xmlrpc.php HTTP/1.0" 500 14213 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; http://www.google.com/bot.html)"
80.82.65.206 - - [27/Sep/2015:10:33:27 +0000] "POST /xmlrpc.php HTTP/1.0" 500 14213 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; http://www.google.com/bot.html)"
I have about 10k lines of this in my access log. What the hell is going on?
回答1:
This is a common scan that is used against WordPress sites. See the following:
https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html
If you notice in your Apache log file, there is no referrer. So using a simple rewrite rule, you can block these requests by putting this in your .htaccess file:
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} ^xmlrcp\.php$
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule .* - [L,R=405]
Alternatively, you can block all POST requests to any file that don't have a referrer by using this:
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule .* - [L,R=405]
Since Laravel won't take POST requests unless you setup a resource controller or specify that a route should handle POST requests, you can ignore these, but I would at least use the first example.
来源：https://stackoverflow.com/questions/32833194/laravel-sessions-and-error-log-files-are-enormous