Strange sentora error log

[Tango]

Hi everybody! Trying to find an error related to a ZXTS module blank page, I found a lot of strange errors:

Code:

[:error] [pid 18872] [client 217.216.85.57:52334] script '/etc/sentora/panel/status.php' not found or unable to stat
[Wed Nov 05 02:39:07.560292 2014] [:error] [pid 23763] [client 162.210.98.109:56279] script '/etc/sentora/panel/wp-config.php' not found or unable to stat
[Wed Nov 05 02:39:08.543781 2014] [:error] [pid 23763] [client 162.210.98.109:56279] script '/etc/sentora/panel/wp-cron.php' not found or unable to stat
[Wed Nov 05 05:07:25.112025 2014] [:error] [pid 8641] [client 62.68.96.183:56644] script '/etc/sentora/panel/etc/lib/pChart2/pChart2.php' not found or unable to stat
[Wed Nov 05 06:19:34.231494 2014] [core:error] [pid 11918] [client 87.255.57.169:54116] AH00126: Invalid URI in request POST 1
[Wed Nov 05 09:25:18.809793 2014] [:error] [pid 19430] [client 95.128.246.45:60955] script '/etc/sentora/panel/admin.php' not found or unable to stat
[Wed Nov 05 09:25:18.809793 2014] [:error] [pid 19458] [client 95.128.246.45:60953] script '/etc/sentora/panel/wp-login.php' not found or unable to stat
[Wed Nov 05 09:42:30.115462 2014] [:error] [pid 20844] [client 95.128.246.45:51322] script '/etc/sentora/panel/admin.php' not found or unable to stat
[Wed Nov 05 09:42:30.117365 2014] [:error] [pid 20829] [client 95.128.246.45:51323] script '/etc/sentora/panel/wp-login.php' not found or unable to stat
[Wed Nov 05 16:26:47.041795 2014] [:error] [pid 17323] [client 62.68.96.183:60052] script '/etc/sentora/panel/etc/lib/pChart2/pChart2.php' not found or unable to stat
[Thu Nov 06 04:45:26.847195 2014] [:error] [pid 2415] [client 62.68.96.183:39652] script '/etc/sentora/panel/etc/lib/pChart2/pChart2.php' not found or unable to stat
[Thu Nov 06 17:59:31.400904 2014] [core:error] [pid 28206] [client 203.195.184.151:57374] AH00126: Invalid URI in request POST 1
[Thu Nov 06 20:08:41.090736 2014] [core:error] [pid 1555] [client 103.9.100.191:52287] AH00126: Invalid URI in request POST 1
[Fri Nov 07 02:35:23.667327 2014] [:error] [pid 1107] [client 78.188.88.224:2811] script '/etc/sentora/panel/wp-login.php' not found or unable to stat
[Fri Nov 07 02:35:23.998901 2014] [:error] [pid 1107] [client 78.188.88.224:2811] script '/etc/sentora/panel/admin.php' not found or unable to stat
[Fri Nov 07 02:54:59.596728 2014] [:error] [pid 2205] [client 78.188.88.224:3488] script '/etc/sentora/panel/wp-login.php' not found or unable to stat
[Fri Nov 07 02:54:59.926504 2014] [:error] [pid 2205] [client 78.188.88.224:3488] script '/etc/sentora/panel/admin.php' not found or unable to stat
[Sat Nov 08 01:37:31.675469 2014] [:error] [pid 6913] [client 62.68.96.183:49631] script '/etc/sentora/panel/etc/lib/pChart2/pChart2.php' not found or unable to stat
[Sat Nov 08 01:42:21.032787 2014] [:error] [pid 6913] [client 62.68.96.183:54433] script '/etc/sentora/panel/etc/lib/pChart2/pChart2.php' not found or unable to stat
[Sat Nov 08 20:27:05.988957 2014] [:error] [pid 2943] [client 198.12.67.116:51922] script '/etc/sentora/panel/etc/lib/pChart2/pChart2.php' not found or unable to stat
[Sat Nov 08 20:36:42.325115 2014] [:error] [pid 3479] [client 198.12.67.116:55205] script '/etc/sentora/panel/etc/lib/pChart2/pChart2.php' not found or unable to stat
[Mon Nov 10 15:51:00.438692 2014] [core:error] [pid 32101] [client 217.197.155.71:37706] AH00126: Invalid URI in request GET HTTP/1.1 HTTP/1.1
[Tue Nov 11 12:28:33.533452 2014] [:error] [pid 21686] [client 176.31.236.14:33022] script '/etc/sentora/panel/wp-login.php' not found or unable to stat
[Tue Nov 11 13:51:25.109492 2014] [core:error] [pid 30255] [client 94.138.219.186:46061] AH00126: Invalid URI in request POST 1
[Tue Nov 11 14:57:25.782342 2014] [core:error] [pid 2015] [client 87.255.57.169:48402] AH00126: Invalid URI in request POST 1
[Wed Nov 12 09:28:51.016402 2014] [core:error] [pid 12695] [client 87.255.57.169:34387] AH00126: Invalid URI in request POST 1
[Wed Nov 12 09:28:52.035107 2014] [core:error] [pid 12687] [client 203.195.184.151:44050] AH00126: Invalid URI in request POST 1

I understand that is "someone" (or some other box), that is trying to access those pages (wp-admin from wordpress administration, for example). The problem is that: Why they acces THERE? (/etc/sentora/panel)

My panel is panel.domain.tld.

I am going to install fail2ban (due to a fresh server install) and I dont realize how to stop those logins attemps.

Any clue?

[TGates]

I get them too from time-to-time and I do not even have wp on my server... 

I think it could be from a bad searchbot that is not configured correctly or a hack trying whatever he can to get in.

[Tango]

Yes, Tgates, a bot is what I tought, I do not have wordpress installed.

It´s a pity the xpanel forum problems... (well, the lost of them), ´cause I cannot find anything related to fail2ban and zpanel. Inside doc.sentora.org, is a list of modules, but the one related to fail2ban (i was curius about it), is broken. It says:

brownweb.com.au/Sentora

And it doesn´t work, but if you enter:

brownweb.com.au/zpanel

It works right. :-)

And PLEASE, change your signature!: Sentora IS RELEASED!!! (¿right?)

Thanks!

EDIT: I don know what fail2ban module does within sentora. Whats the point of including it as a sentora module? I cant find any related information... Well, tomorrow I will unpack the zpp, and will investigate.

Greets!

[Me.B]

Sentora is still final stage beta

[Tango]

Ouch! Sorry.

[5050]

The problem is that: Why they acces THERE? (/etc/sentora/panel)

My panel is panel.domain.tld.

hi,

I (and probably every servers) have hundred of such attempts.

I think these file are searched by hack bots because some version have security failure, in attempt to hack the server which hosts them.
As I was bored from these logs and attempts, I redirected the 10 most targeted files to a garbage file, so they can play with it ! (the extra load of the server is even not visible) :-)


The access to files /etc/sentora/panel correspond to your panel URL, but also to access to the server by IP.
You can block access by IP by creating a default virtual host placed BEFORE the first real vhosts, so it must reside in /etc/sentora/configs/apache/httpd.conf file, before the call to vhost file.

The end of my httpd.conf file look like that :

Code:

#default

site to forbid sentora login page from direct IP access

Listen 80
<virtualhost *:80>
   redirect 404 /
</virtualhost>

# Include the generic VHOST configuration file that holds all vhosts
Include /etc/sentora/configs/apache/httpd-vhosts.conf

[Tango]

Ok, thank you!

With this, and FAIL2BAN, i feel safe... :-)