WordPress — 性能瓶颈，遭遇攻击

上一篇写了关于 《突破WordPress性能瓶颈——使用WordPress站群做SEO推广》。在最近的时间里，服务器依旧会瘫掉，无法处理HTTP请求。（每台Server安装了50个WP博客，每篇博客每天都有几十篇博客的更新，Google等各大主流爬虫成天都在爬）。分析了Apache的日志文件(/etc/httpd/logs/access_log)后发现有大量的扫描网站漏洞的程序在猜phpMyAdmin的后台路径等。

213.149.105.61 - - [05/Apr/2012:22:03:39 -0400] "GET /mysql/index.php HTTP/1.1" 404 292 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
213.149.105.61 - - [05/Apr/2012:22:03:39 -0400] "GET /myadmin/index.php HTTP/1.1" 404 294 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
213.149.105.61 - - [05/Apr/2012:22:03:39 -0400] "GET /dbadmin/index.php HTTP/1.1" 404 294 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
213.149.105.61 - - [05/Apr/2012:22:03:39 -0400] "GET /admin/phpmyadmin/index.php HTTP/1.1" 301 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
213.149.105.61 - - [05/Apr/2012:22:03:39 -0400] "GET /db/index.php HTTP/1.1" 301 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
213.149.105.61 - - [05/Apr/2012:22:03:39 -0400] "GET /mysqladmin/index.php HTTP/1.1" 404 297 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
213.149.105.61 - - [05/Apr/2012:22:03:39 -0400] "GET /mysql/index.php HTTP/1.1" 404 292 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
213.149.105.61 - - [05/Apr/2012:22:03:40 -0400] "GET /myadmin/index.php HTTP/1.1" 404 294 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
213.149.105.61 - - [05/Apr/2012:22:03:40 -0400] "GET /db/index.php HTTP/1.1" 301 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
213.149.105.61 - - [05/Apr/2012:22:03:40 -0400] "GET /typo3/phpmyadmin/index.php HTTP/1.1" 404 303 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
213.149.105.61 - - [05/Apr/2012:22:03:40 -0400] "GET /mysqladmin/index.php HTTP/1.1" 404 297 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
213.149.105.61 - - [05/Apr/2012:22:03:40 -0400] "GET /mysql/index.php HTTP/1.1" 404 292 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"
213.149.105.61 - - [05/Apr/2012:22:03:40 -0400] "GET /dbadmin/index.php HTTP/1.1" 301 - "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1"

那么为何Server上的WP博客对于如上的攻击会不堪一击呢？答案就在于我Server上的WP博客配置使用了自定义Permalink，使用了自定义Permalink后，对于每个URL，WP程序都需要去尝试解析URL是否正确。那么这里就会带来对Mysql数据库的访问。当扫描程序对Server上的几个或几十个博客进行扫描的话，那么Mysql的连接数很快就会让Server当机了。默认的Mysql5.1的连接数为151，那么这个数值对于一个安装了50个WP的Server来说。一旦有扫描程序来，也就5分钟左右Server的Mysql的连接数就会飙到151。我在这篇文章— Centos下修改mysql默认最大连接数 里提到了修改Mysql的连接数为1000。结果就是在一次的攻击中，Mysql的连接数飙到了760，导致我SSH都无法连接。只能联系机房硬重启机器。

---

解决办法：

对于某些特定 User Agent, 我们可以在Apache的配置文件httpd.conf或者网站的.htaccess文件中去屏蔽它。比如我就是修改了Apache的配置文件httpd.conf。

比如我屏蔽了对于”ZmEu“的恶意扫描：

== 恶意扫描日志 ==

209.15.236.190 - - [04/Apr/2012:03:30:32 -0400] "GET //phpmyadmin/ HTTP/1.1" 404 288 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
209.15.236.190 - - [04/Apr/2012:03:30:32 -0400] "GET //phpMyAdmin/ HTTP/1.1" 404 288 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
209.15.236.190 - - [04/Apr/2012:03:30:32 -0400] "GET //PMA/ HTTP/1.1" 404 281 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
209.15.236.190 - - [04/Apr/2012:03:30:32 -0400] "GET //phpmyadmin/ HTTP/1.1" 301 - "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
209.15.236.190 - - [04/Apr/2012:03:30:32 -0400] "GET //pma/ HTTP/1.1" 404 281 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"

在httpd.conf中配置的网站的目录小节中做如下修改

<Directory "/home/website">
    SetEnvIfNoCase User-Agent "ZmEu" getout
    Options -Indexes FollowSymLinks
    AllowOverride All
    Order allow,deny
    Allow from all
    deny from env=getout
</Directory>

以上红色的2行是需要添加的。其中蓝色的为User Agent中出现的关键词，也就是你要屏蔽的HTTP请求。

对于那些修改了看似正常的User Agent来恶意扫描的。屏蔽IP其实不是个好办法，（每次扫描的IP都在变）。那就选择最简单、最笨的办法，不适用WP博客的自定义Permalink，使用默认的URL（就是带查询参数的: /?p=1170）。