Re: Need some help on security
From: Robert Watson (rwatson_at_freebsd.org)
Date: 01/11/04
- Previous message: David Edwards: "Need some help on security"
- In reply to: David Edwards: "Need some help on security"
- Next in thread: Dan Pelleg: "Re: Need some help on security"
- Reply: Dan Pelleg: "Re: Need some help on security"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sat, 10 Jan 2004 21:47:47 -0500 (EST) To: David Edwards <david@deassociates.com>
On Sat, 10 Jan 2004, David Edwards wrote:
> Anyway, on to the question, lastnight, the server stopped responding
> after someone tried to gain access to what looks to be web based
> printing. I am not familiar with any firewall/IDS solutions and have
> looked over Snort and IPFW today. I don't want to do IPFW because I
> don't want to recompile a kernel that works and potentially lose
> everything I have done so far. Here is a bit of the apache error_log
> which shows the issue i am refering to:
>
> [Sat Jan 10 01:34:04 2004] [error] [client 211.233.89.189] File does not
> exist: /usr/home/dbcenter/public_html/NULL.printer
> [Sat Jan 10 01:34:04 2004] [error] [client 211.233.89.189] File does not
> exist: /usr/local/apache/htdocs/NULL.printer
Well, these log entries are for attempted exploits of Microsoft's IIS, and
shouldn't be a problem. The error messages can safely be ignored.
However, the "server stopped responding" bit doesn't sound good. Was the
web server still running (i.e., Apache processes still present)? What
does "ps -alx" show? Were there any console messages regarding apache
stopping, or any error messages in the Apache log about it exiting or
changing states, as opposed to just file not found errors?
Robert N M Watson FreeBSD Core Team, TrustedBSD Projects
robert@fledge.watson.org Senior Research Scientist, McAfee Research
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
- Previous message: David Edwards: "Need some help on security"
- In reply to: David Edwards: "Need some help on security"
- Next in thread: Dan Pelleg: "Re: Need some help on security"
- Reply: Dan Pelleg: "Re: Need some help on security"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
