ich betreibe seit einigen Jahren einen eigenen Webserver (Apache Haus 2.4 - mit PHP), den ich auch selbst hoste. Das ganze gehört zu einem Projekt, dass ich mit einigen Freunden gegründet habe, auch wenn ich der einzige bin, der programmieren kann.
Seit ca 3-4 Monaten sind mir jedoch vermehrt komische/ungewöhnliche Zugriffe auf die Website in den Logs aufgefallen (Beispiele am Ende). Die IPs stammen aus den verschiedensten Ländern (Afghanistan, Indien, China, USA) und es scheint ganz, als würden Bots die Website nach Schwachstelle absuchen. Ich habe meine gesamte Website mit dem Apache auth_form Modul gesichert.
Es werden größtenteils URIs wie solche von PHPMyAdmin oder dem /cgi-bin/ Verzeichniss abgefragt, da dort bekanntlicherweise wichtige Dateien liegen (können). Ich habe von Anfang an die Website so entwickelt, dass in dem DocumentRoot keinerlei Wichtige Informationen/Dateien zu finden sind (ausser man würde die index.php Dateien unkompiliert auslesen, da dort Datenbankverbindungen hergestellt werden).
Meine Fragen sind nun:
- Sind solche Zugriffe normal (Die Website ist über eine Domain erreichbar)
- Muss ich mir sorgen machen, dass die Angreifer durch diese Abfragen irgendwelche Sicherheitslucken (z.B. Seitens Apache) entdecken/ausnutzen können? (Ich selber habe ja keine sensiblen Verzeichnisse oder Dateien im DocumentRoot angelegt)
- Kann man solche Zugriffe geziehlt verhindern? (z.B. IP Blacklists? Wenn ja wo finde ich die?)
- Wie sicher ist das Apache auth_form Modul?
- Was ratet ihr mir, zu tun? Wie soll ich darauf reagieren?
Ich freue mich über jede Hilfe, da ich aktuell nicht weiß, wie ich darauf reagieren soll.
LG, PXLKNG
Beispiele:
114.35.62.162 - - [03/Aug/2019:06:57:44 +0200] "GET /mysql/admin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:45 +0200] "GET /mysql/dbadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:45 +0200] "GET /mysql/sqlmanager/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:46 +0200] "GET /mysql/mysqlmanager/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:47 +0200] "GET /phpmyadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:47 +0200] "GET /phpMyadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:48 +0200] "GET /phpMyAdmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:49 +0200] "GET /phpmyAdmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:49 +0200] "GET /phpmyadmin2/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:50 +0200] "GET /phpmyadmin3/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:51 +0200] "GET /phpmyadmin4/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:51 +0200] "GET /2phpmyadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:52 +0200] "GET /wp-content/plugins/portable-phpmyadmin/wp-pma-mod/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:53 +0200] "GET /phpmy/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:53 +0200] "GET /phppma/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:54 +0200] "GET /myadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:55 +0200] "GET /shopdb/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:55 +0200] "GET /MyAdmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:56 +0200] "GET /program/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:57 +0200] "GET /PMA/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:57 +0200] "GET /dbadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:58 +0200] "GET /pma/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:59 +0200] "GET /db/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:57:59 +0200] "GET /admin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:00 +0200] "GET /mysql/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:01 +0200] "GET /database/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:01 +0200] "GET /db/phpmyadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:02 +0200] "GET /db/phpMyAdmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:03 +0200] "GET /sqlmanager/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:03 +0200] "GET /mysqlmanager/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:04 +0200] "GET /php-myadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:05 +0200] "GET /phpmy-admin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:06 +0200] "GET /mysqladmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:06 +0200] "GET /mysql-admin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:07 +0200] "GET /admin/phpmyadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:08 +0200] "GET /admin/phpMyAdmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:08 +0200] "GET /admin/sysadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:09 +0200] "GET /admin/sqladmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:10 +0200] "GET /admin/db/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:11 +0200] "GET /admin/web/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:11 +0200] "GET /admin/pMA/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:12 +0200] "GET /mysql/pma/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:13 +0200] "GET /mysql/db/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:14 +0200] "GET /mysql/web/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:14 +0200] "GET /mysql/pMA/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:15 +0200] "GET /sql/phpmanager/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:16 +0200] "GET /sql/php-myadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:16 +0200] "GET /sql/phpmy-admin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:17 +0200] "GET /sql/sql/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:18 +0200] "GET /sql/myadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:18 +0200] "GET /sql/webadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:19 +0200] "GET /sql/sqlweb/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:20 +0200] "GET /sql/websql/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:20 +0200] "GET /sql/webdb/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:21 +0200] "GET /sql/sqladmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:22 +0200] "GET /sql/sql-admin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:23 +0200] "GET /sql/phpmyadmin2/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:23 +0200] "GET /sql/phpMyAdmin2/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:24 +0200] "GET /sql/phpMyAdmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:25 +0200] "GET /db/myadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:25 +0200] "GET /db/webadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:26 +0200] "GET /db/dbweb/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:27 +0200] "GET /db/websql/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:27 +0200] "GET /db/webdb/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:28 +0200] "GET /db/dbadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:29 +0200] "GET /db/db-admin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:29 +0200] "GET /db/phpmyadmin3/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:30 +0200] "GET /db/phpMyAdmin3/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:31 +0200] "GET /db/phpMyAdmin-3/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:31 +0200] "GET /administrator/phpmyadmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:32 +0200] "GET /administrator/phpMyAdmin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:33 +0200] "GET /administrator/db/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:33 +0200] "GET /administrator/web/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:34 +0200] "GET /administrator/pma/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:35 +0200] "GET /administrator/PMA/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:35 +0200] "GET /administrator/admin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:36 +0200] "GET /phpMyAdmin2/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:37 +0200] "GET /phpMyAdmin3/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:37 +0200] "GET /phpMyAdmin4/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:38 +0200] "GET /phpMyAdmin-3/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:39 +0200] "GET /php-my-admin/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:40 +0200] "GET /PMA2011/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:40 +0200] "GET /PMA2012/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:41 +0200] "GET /PMA2013/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:42 +0200] "GET /PMA2014/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:42 +0200] "GET /PMA2015/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:43 +0200] "GET /PMA2016/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:44 +0200] "-" 408 -
114.35.62.162 - - [03/Aug/2019:06:58:44 +0200] "GET /PMA2017/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:44 +0200] "GET /PMA2018/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:45 +0200] "GET /pma2011/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:46 +0200] "GET /pma2012/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:46 +0200] "GET /pma2013/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:47 +0200] "GET /pma2014/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:48 +0200] "GET /pma2015/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:48 +0200] "GET /pma2016/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:49 +0200] "GET /pma2017/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:50 +0200] "GET /pma2018/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:50 +0200] "GET /pma2019/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:51 +0200] "GET /phpmyadmin2011/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:52 +0200] "GET /phpmyadmin2012/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:52 +0200] "GET /phpmyadmin2013/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:53 +0200] "GET /phpmyadmin2014/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:54 +0200] "GET /phpmyadmin2015/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:54 +0200] "GET /phpmyadmin2016/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:55 +0200] "GET /phpmyadmin2017/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:56 +0200] "GET /phpmyadmin2018/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:56 +0200] "GET /phpmyadmin2019/index.php?lang=en HTTP/1.1" 302 190
114.35.62.162 - - [03/Aug/2019:06:58:57 +0200] "GET /index.php?lang=en HTTP/1.1" 302 190
197.41.76.112 - - [04/Aug/2019:22:52:44 +0200] "23&remoteSubmit=Save" 400 226
197.41.76.112 - - [04/Aug/2019:22:52:44 +0200] "POST /cgi-bin/ViewLog.asp HTTP/1.1" 302 190
78.39.67.210 - - [03/Aug/2019:07:04:14 +0200] "GET /admin//config.php HTTP/1.1" 302 190
27.224.136.156 - - [03/Aug/2019:15:11:06 +0200] "GET http://wujieliulan.com/mnews.htm HTTP/1.1" 302 190 (Warum "GET [Domain]" ???; Diese Abfrage taucht sehr häufig auf)
169.197.108.30 - - [03/Aug/2019:01:08:59 +0200] "GET /secure/ContactAdministrators!default.jspa HTTP/1.1" 302 190
157.230.115.62 - - [31/Jul/2019:22:58:21 +0200] "GET / HTTP/1.1" 302 190
157.230.115.62 - - [31/Jul/2019:22:58:21 +0200] "GET /auth/ HTTP/1.1" 401 5184
178.73.215.171 - - [31/Jul/2019:23:46:05 +0200] "GET / HTTP/1.0" 302 190
198.167.223.52 - - [01/Aug/2019:03:25:31 +0200] "GET /test.php HTTP/1.1" 302 190
178.79.149.109 - - [01/Aug/2019:03:32:28 +0200] "GET / HTTP/1.0" 400 362
178.79.149.109 - - [01/Aug/2019:03:32:29 +0200] "GET /api/v1 HTTP/1.1" 302 190
178.79.149.109 - - [01/Aug/2019:03:32:29 +0200] "GET /auth/ HTTP/1.1" 401 5184
84.95.214.222 - - [30/Jul/2019:23:43:36 +0200] "GET /cgi-bin/webcm?getpage=../html/menus/menu2.html&var:lang=%26%20allcfgconv%20-C%20voip%20-c%20-o%20-%20../../../../../var/tmp/voip.cfg%20%26 HTTP/1.1" 302 190
128.14.134.170 - - [30/Jul/2019:15:32:01 +0200] "GET /cgi-bin/config.exp HTTP/1.1" 302 190
138.246.253.5 - - [30/Jul/2019:20:07:55 +0200] "HEAD / HTTP/1.1" 400 -
169.197.108.42 - - [29/Jul/2019:23:04:04 +0200] "GET /version HTTP/1.1" 302 190
185.234.217.41 - - [01/Jul/2019:23:43:10 +0200] "GET /wallet.dat HTTP/1.1" 302 190
185.234.217.41 - - [01/Jul/2019:23:43:10 +0200] "GET /auth/ HTTP/1.1" 401 5142
185.234.217.41 - - [01/Jul/2019:23:43:10 +0200] "GET /node/wallet.dat HTTP/1.1" 302 190
185.234.217.41 - - [01/Jul/2019:23:43:10 +0200] "GET /auth/ HTTP/1.1" 401 5142
185.234.217.41 - - [01/Jul/2019:23:43:10 +0200] "GET /hidden/wallet.dat HTTP/1.1" 302 190
185.234.217.41 - - [01/Jul/2019:23:43:10 +0200] "GET /auth/ HTTP/1.1" 401 5142
185.234.217.41 - - [01/Jul/2019:23:43:10 +0200] "GET /wallet/wallet.dat HTTP/1.1" 302 190
185.234.217.41 - - [01/Jul/2019:23:43:10 +0200] "GET /auth/ HTTP/1.1" 401 5142
185.234.217.41 - - [01/Jul/2019:23:43:11 +0200] "GET /btc/wallet.dat HTTP/1.1" 302 190
185.234.217.41 - - [01/Jul/2019:23:43:11 +0200] "GET /auth/ HTTP/1.1" 401 5142
185.234.217.41 - - [01/Jul/2019:23:43:11 +0200] "GET /bitcoin/wallet.dat HTTP/1.1" 302 190
185.234.217.41 - - [01/Jul/2019:23:43:11 +0200] "GET /auth/ HTTP/1.1" 401 5142
185.234.217.41 - - [01/Jul/2019:23:43:11 +0200] "GET /.bitcoin/wallet/wallet.dat HTTP/1.1" 302 190
185.234.217.41 - - [01/Jul/2019:23:43:11 +0200] "GET /auth/ HTTP/1.1" 401 5142
185.234.217.41 - - [01/Jul/2019:23:43:11 +0200] "GET /.bitcoin/wallet.dat HTTP/1.1" 302 190
185.234.217.41 - - [01/Jul/2019:23:43:11 +0200] "GET /auth/ HTTP/1.1" 401 5142
185.234.217.41 - - [01/Jul/2019:23:43:12 +0200] "GET /core/wallet.dat HTTP/1.1" 302 190
185.234.217.41 - - [01/Jul/2019:23:43:12 +0200] "GET /auth/ HTTP/1.1" 401 5142
185.234.217.41 - - [01/Jul/2019:23:43:12 +0200] "GET /coin/wallet.dat HTTP/1.1" 302 190
185.234.217.41 - - [01/Jul/2019:23:43:12 +0200] "GET /auth/ HTTP/1.1" 401 5142
185.234.217.41 - - [01/Jul/2019:23:43:12 +0200] "GET /backup/wallet.dat HTTP/1.1" 302 190
185.234.217.41 - - [01/Jul/2019:23:43:12 +0200] "GET /auth/ HTTP/1.1" 401 5142
185.234.217.41 - - [01/Jul/2019:23:43:12 +0200] "GET /bitcoin/wallet/wallet.dat HTTP/1.1" 302 190
185.234.217.41 - - [01/Jul/2019:23:43:12 +0200] "GET /auth/ HTTP/1.1" 401 5142
185.234.217.41 - - [01/Jul/2019:23:43:13 +0200] "GET /crypto/wallet.dat HTTP/1.1" 302 190
185.234.217.41 - - [01/Jul/2019:23:43:13 +0200] "GET /auth/ HTTP/1.1" 401 5142
178.62.203.61 - - [13/Jun/2019:22:18:28 +0200] "GET /api/v1/pods HTTP/1.1" 302 190
162.241.4.196 - - [11/Jun/2019:00:19:00 +0200] "GET /login_sid.lua?user=root&response=-eb9b71794e80e657c0cda69b069d041b HTTP/1.1" 302 190
Viele Weitere... (auf Anfrage kann ich noch mehr schicken, wenns helfen sollte)