Server probing and hacking..

[A32]

1) Do you guys run any kind of security analysis on your servers?

I have been getting numerous probes and I dont think they are getting in but I have noticed that a lot of the probes are looking for phpmyadmin..

67.154.187.226 - - [08/Nov/2005:22:50:23 -0600] "GET /phpmyadmin/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:23 -0600] "GET /PMA/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:23 -0600] "GET /mysql/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:23 -0600] "GET /admin/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:23 -0600] "GET /db/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:23 -0600] "GET /dbadmin/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:23 -0600] "GET /index.php HTTP/1.0" 200 4991 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:23 -0600] "GET /web/phpMyAdmin/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:23 -0600] "GET /admin/pma/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:23 -0600] "GET /index.php HTTP/1.0" 200 4991 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:23 -0600] "GET /admin/phpmyadmin/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:23 -0600] "GET /admin/mysql/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:23 -0600] "GET /index.php HTTP/1.0" 200 4991 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:23 -0600] "GET /mysql-admin/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:24 -0600] "GET /phpmyadmin2/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:24 -0600] "GET /index.php HTTP/1.0" 200 4991 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:24 -0600] "GET /mysqladmin/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:24 -0600] "GET /mysql-admin/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:24 -0600] "GET /index.php HTTP/1.0" 200 4991 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:24 -0600] "GET /main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:24 -0600] "GET /phpMyAdmin-2.5.6/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:24 -0600] "GET /phpMyAdmin-2.5.4/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:24 -0600] "GET /phpMyAdmin-2.5.1/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:24 -0600] "GET /index.php HTTP/1.0" 200 4991 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:24 -0600] "GET /phpMyAdmin-2.2.3/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:25 -0600] "GET /phpMyAdmin-2.2.6/main.php HTTP/1.0" 302 286 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:25 -0600] "GET /index.php HTTP/1.0" 200 4991 "-" "pmafind"
67.154.187.226 - - [08/Nov/2005:22:50:25 -0600] "GET /myadmin/main.php HTTP/1.0" 302 286 "-" "pmafind"

See all those 302's? w3c defines 302's as:

10.3.3 302 Found

The requested resource resides temporarily under a different URI. Since the redirection might be altered on occasion, the client SHOULD continue to use the Request-URI for future requests.

Now, why is it responding with a 302 if these files do not exist? Shouldnt it be responding with a 404?

[Serra]

Just someone looking for access to your mysql, nothing to worry about really, if your server is secure (which we assume they are), then they will never find the security hole they are looking for.

Plus looking at the times of access, you can see that it is a script running, so they don't even have any specific knowledge about your system, they are just trying everything.


If it bothers you, put that IP on your deny list and be done with it.

Yeah I ban IPs all the time.. But my original question remains to be unanswered by *everybody* not just you.. I have posted on other forums & asked tech support on other providers but never got any answer...

So why the 302's and not 404? I get them both WITH ErrorDocument 404 blah blah AND without. Ever since Ive started making websites, these things always respond with 302 instead of 404.