Re: apache and nimbda

From: John Oliver (john.oliver@hosting.com)
Date: 01/28/02 

Date: Mon, 28 Jan 2002 12:59:26 -0800
From: John Oliver <john.oliver@hosting.com>
To: focus-linux@securityfocus.com

Brian Clifton wrote:
>
> Dear All
>
> Is there a way to stop apache responding to .exe file requests altogether?
>
> I am getting fed up with my error_log file being filled by nimbda and we don't host any .exe files!! I have been monitoring
> it since the summer and the number of nimbda type entries appears to have started to go up again since xmas...

Well, you'd need a patch that makes Apache prescient, so it know a
request was about to be made... :-)

The logs show what happened. I'm sure you could disable logging for
just .exes by hacking the source, but that's going to a lot of trouble
to break something that's there for a reason.

Alternatively, I would recommend that you use Early Bird
http://www.treachery.net/~jdyson/earlybird/ to automagically LART all
those Nimda-infected hosts. I set up EB to LART every single instance
of Nimda, and I hardly see any attempts any more. If nothing else, the
ISPs hosting those broken boxes will get tired of receiving the reports
and make the customer or user fix the problem. 

-- 
John Oliver
System Administrator
hosting.com, an Allegiance Telecom company
mailto:john.oliver@hosting.com
(858) 637-3600
http://www.hosting.com/

Relevant Pages

  • Re: apache and nimbda
    ... > Is there a way to stop apache responding to .exe file requests ... > and the number of nimbda type entries appears to have started to go up ...
    (Focus-Linux)
  • Re: apache and nimbda
    ... > Is there a way to stop apache responding to .exe file requests altogether? ... > it since the summer and the number of nimbda type entries appears to have started to go up again since xmas... ...
    (Focus-Linux)