note 60167 added to security.hiding

Even you hide your PHP, requests for bugy scripts still come. No matter whether you have the script on your server or not. You can make an additional step for those requests. Since the host now trying that buggy script then, in the future when a new bug arises it will be tried by that host again with a high possibility. So banning that host completey at its first attempt may be a good idea. For this, 1- Add Permanent links for those requests in your httpd.conf: RedirectMatch permanent (.*)awstats(.*)$ http://your_server/your_script.html RedirectMatch permanent (.*)xmlrpc(.*)$ http://your_server/your_script.html and add whatever you want to ban. 2- Write following code in your_script.html <? $host= $_SERVER['REMOTE_ADDR']; $dropit = "iptables -A INPUT -i eth0 -p tcp -s $host -m multiport --destination-ports 80,25,22 -j DROP"; shell_exec($dropit); exit ?> Yavuz Darendelioglu ---- Manual Page -- http://www.php.net/manual/en/security.hiding.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+60167 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+60167&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+60167&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+60167&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+60167&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+60167&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+60167&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+60167&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+60167&report=yes Search -- http://master.php.net/manage/user-notes.php