RE: iptables anti-nimda anyone?

From: Chris Freeze (CFreeze@COMCEPTINC.COM)
Date: 09/21/01 

From: Chris Freeze <CFreeze@COMCEPTINC.COM>
To: Konrad Michels <konrad@overnetdata.com>
Message-ID: <XFMail.20010921090048.cfreeze@comceptinc.com>
Date: Fri, 21 Sep 2001 09:00:48 -0500 (CDT)
Subject: RE: iptables anti-nimda anyone?

On 19-Sep-2001 Konrad Michels wrote:
> Hi everyone
> I don't suppose one of our iptables gurus out there has an iptables rule
> to filter out this damn nimda thing? I'm really annoyed about it
> filling up my apache logz and would love to drop the packets 'ere they
> get to the apache server . . .

Here's a simple little script from Mario Kerecki <marker@radiomoi.com>

#!/bin/sh
  #
  # Block sites which originate Nimba queries from Apache server
  # Apache must be configured with HostnameLookups Off
  LOGS=/http_php3/logs
  cd $LOGS
  grep '^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* ' * 2>/dev/null |
  awk '/system32\/cmd\.exe/ {sub(/[^:]*:/,"");print $1}' |
  sort -u |
  while read host
  do
  if ! fgrep $host /var/tmp/blocked >/dev/null
  then
  echo $host >>/var/tmp/blocked
  /sbin/iptables -I INPUT -s $host -l -j DROP
  fi
  done 

-- 
Regards,

Chris

-----
Chris Freeze                            Email: cfreeze@comceptinc.com
Software Engineer
Comcept, Inc                            Phone: (972) 772-6804 (Ext 5038)
http://www.cfreeze.com
-----

Relevant Pages

  • [SLE] unknown connect from my linux to my linux on port 443
    ... In my iptables logfiles I found in regular intervals the following ... As I discovered this I set my iptables rule to DROP this kind of traffic ... traffic I got SYN & ACK & RST Flags in the logs but after setting the ... I´ve tried to find something in my apache logfiles but there is no ...
    (SuSE)
  • Re: hosts.deny vs iptables
    ... Web Server with virtual hosts; FC4; IPTables and SELinux Running ... Because, apache does not use TCP wrappers, hosts.deny would be ineffective for http requests. ...
    (Fedora)
  • Re: [PHP] problem with url_fopen on free hosting environment
    ... I tried to limit connections with iptables, but it did not work out. ... I know it just limits new connections, and I thought this would work out, but it didn't. ... There's also mod_bandwidth for Apache, not included in the aforementioned topic. ... Confidentiality: ...
    (php.general)
  • Re: block CodeRed/Nimda at the firewall?
    ... > they would never distract Apache in the first place). ... > Is it possible, for example, drop any file request that contains ... Yes I belive so - if you use the 'string' module of iptables. ... chris at lowth dot sea oh em. ...
    (comp.os.linux.security)
  • Re: DNS or URL redirector for WiFi hotspot?
    ... >> So what I did was add the apache user to sudoers but only for the ... >> iptables command. ... >Why not just get apache to write some kind of flag file, ... When I get some time I'll try limiting the sudoers apache entry to ...
    (uk.comp.os.linux)