root@zion /# ll /var/log/hiawatha/
total 6
-rw-r----- 1 www www 0 Dec 4 09:05 access.log
-rw-r----- 1 www www 0 Dec 4 09:05 error.log
-rw-r----- 1 www www 0 Dec 4 09:05 exploit.log
-rw-r----- 1 www www 0 Dec 4 09:05 garbage.log
-rw-r----- 1 www www 0 Dec 4 09:05 system.log
-rw-r----- 1 www www 0 Dec 4 09:05 dupon.access.log
-rw-r----- 1 www www 0 Dec 4 09:05 dupon.error.log
# Hiawatha main configuration file
#
# GENERAL SETTINGS
#
ServerId = www
ConnectionsTotal = 1000
ConnectionsPerIP = 10
SystemLogfile = /var/log/hiawatha/system.log
GarbageLogfile = /var/log/hiawatha/garbage.log
ExploitLogfile = /var/log/hiawatha/exploit.log
LogFormat = extended
ServerString = Apache
CGIwrapper = /usr/local/sbin/cgi-wrapper
# BINDING SETTINGS
# A binding is where a client can connect to.
#
Binding {
Port = 80
# Interface = 192.168.1.125
MaxKeepAlive = 30
TimeForRequest = 3,20
}
#
#Binding {
# Port = 443
# Interface = ::1
# MaxKeepAlive = 30
# TimeForRequest = 3,20
# SSLcertFile = hiawatha.pem
#}
# BANNING SETTINGS
# Deny service to clients who misbehave.
#
BanOnGarbage = 300
BanOnMaxPerIP = 60
BanOnMaxReqSize = 300
KickOnBan = yes
RebanDuringBan = yes
BanOnDeniedBody = 300
BanOnSQLi = 300
BanOnFlooding = 10/1:15
BanOnInvalidURL = 300
BanOnWrongPassword = 3:300
BanlistMask = allow 82.31.44.171, allow 213.146.159.254, deny 192.168.1.0/24, deny 127.0.0.1
ReconnectDelay = 3
# COMMON GATEWAY INTERFACE (CGI) SETTINGS
# These settings can be used to run CGI applications.
#
#CGIhandler = /usr/local/bin/perl:pl
CGIhandler = /usr/local/bin/php-cgi:php
#CGIhandler = /usr/local/bin/python:py
#CGIhandler = /usr/local/bin/ruby:rb
#CGIhandler = /usr/local/bin/ssi-cgi:shtml
#CGIextension = cgi
#
FastCGIserver {
FastCGIid = PHP5
#ConnectTo = 127.0.0.1:2005
ConnectTo = /var/run/php-fpm.sock
Extension = php
SessionTimeout = 30
}
# URL TOOLKIT
# This URL toolkit rule was made for the Banshee PHP framework, which
# can be downloaded from http://www.hiawatha-webserver.org/banshee
#
#UrlToolkit {
# ToolkitID = banshee
# RequestURI isfile Return
# Match ^/(css|files|images|js|slimstat)($|/) Return
# Match ^/(favicon.ico|robots.txt|sitemap.xml)$ Return
# Match .*\?(.*) Rewrite /index.php?$1
# Match .* Rewrite /index.php
#}
UrlToolkit {
ToolkitID = block_bots
Header User-Agent Googlebot DenyAccess
Header User-Agent twiceler DenyAccess
Header User-Agent MSNBot DenyAccess
Header User-Agent yahoo DenyAccess
Header User-Agent BaiDuSpider DenyAccess
Header User-Agent Ask DenyAccess
# Header User-Agent Yahoo! Slurp DenyAccess
# Header User-Agent Sogou web spider DenyAccess
Header User-Agent Sogou-Test-Spider DenyAccess
Header User-Agent Baiduspider+ DenyAccess
Header User-Agent Yandex DenyAccess
Header User-Agent UniversalFeedParser DenyAccess
Header User-Agent Mediapartners-Google DenyAccess
Header User-Agent Sosospider+ DenyAccess
Header User-Agent YoudaoBot DenyAccess
Header User-Agent ParchBot DenyAccess
Header User-Agent Curl DenyAccess
Header User-Agent msnbot DenyAccess
Header User-Agent NaverBot DenyAccess
Header User-Agent taptubot DenyAccess
}
# DEFAULT WEBSITE
# It is wise to use your IP address as the hostname of the default website
# and give it a blank webpage. By doing so, automated webscanners won't find
# your possible vulnerable website.
#
Hostname = 127.0.0.1
WebsiteRoot = /usr/local/www/hiawatha
StartFile = index.html
AccessLogfile = /var/log/hiawatha/access.log
ErrorLogfile = /var/log/hiawatha/error.log
#ErrorHandler = 404:/error.cgi
Include enable-sites/
# VIRTUAL HOSTS
# Use a VirtualHost section to declare the websites you want to host.
#
#VirtualHost {
# Hostname = www.my-domain.com
# WebsiteRoot = /var/www/my-domain/public
# StartFile = index.php
# AccessLogfile = /var/www/my-domain/log/access.log
# ErrorLogfile = /var/www/my-domain/log/error.log
# TimeForCGI = 5
# UseFastCGI = PHP5
# UseToolkit = banshee
#}
# DIRECTORY SETTINGS
# You can specify some settings per directory.
#
#Directory {
# Path = /home/baduser
# ExecuteCGI = no
# UploadSpeed = 10,2
#}
213.146.159.254 - - [04/Dec/2014:12:00:02 +0000] "GET /wp-content/plugins/themefuse-maintenance-mode/images/tabs_t.png HTTP/1.1" 304 0 "http://mysite.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
213.146.159.254 - - [04/Dec/2014:12:00:02 +0000] "GET /wp-content/plugins/themefuse-maintenance-mode/css/bebasneue-webfont.ttf HTTP/1.1" 304 0 "http://mysite.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
213.146.159.254 - - [04/Dec/2014:12:00:02 +0000] "GET /wp-content/plugins/themefuse-maintenance-mode/images/mail.png HTTP/1.1" 304 0 "http://mysite.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
213.146.159.254 - - [04/Dec/2014:12:00:02 +0000] "GET /wp-content/plugins/themefuse-maintenance-mode/images/tabs_bottom_container_bg.png HTTP/1.1" 304 0 "http://mysite.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
213.146.159.254 - - [04/Dec/2014:12:00:02 +0000] "GET /wp-content/plugins/themefuse-maintenance-mode/images/message_active.png HTTP/1.1" 304 0 "http://mysite.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"