Newsgroup: it.comp.os.linux.iniziare
Titolo: Problemi di sicurezza con apache?

Leggendo i log di apache ho notato che:
1) Ci sono delle strane richieste HEAD (normalmente non sono GET?).
2) Mi preoccupa che queste richieste sono a raffica (fatte da un
programma per chissà quale uso).
3) Nella penultima riga del log c'è il percorso esatto della cartella
etc (il numero esatto di ../).
4) Devo preoccuparmi? Devo aggiornare il livello di sicurezza?
In caso estremo (e per semplicità) posso bloccare HTTP da remoto
serve solo a me per scrivere programmi PHP/MYSQL che poi metto su un
altro server.
Grazie mille, ciao 
##############################################
############# LOG DI APACHE ##################
##############################################
194.29.26.126 - - [10/Sep/2002:17:48:18 +0200] 
"HEAD / HTTP\1.0" 200 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:28 +0200] 
"HEAD /// HTTP/1.0" 200 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:28 +0200] 
"HEAD ///server-info HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:28 +0200] 
"HEAD ///server-status HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"HEAD /site/eg/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"HEAD /doc/ HTTP/1.0" 403 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"GET /doc// HTTP/1.0" 403 271 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"GET /doc/packages HTTP/1.0" 403 278 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"HEAD /~nobody/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"HEAD ///manual/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"HEAD /cgi-bin/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"HEAD /// HTTP/1.0" 200 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"HEAD ///carbo.ddl HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"HEAD /technote/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"HEAD /iisadmpwd/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"HEAD /cgi-dos/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"HEAD /scripts/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"HEAD /mall_log_files/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"HEAD /Admin_files/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:29 +0200] 
"GET ///quote.html HTTP/1.0" 404 6044 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:30 +0200] 
"HEAD /cgi-bin/ikonboard/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:30 +0200] 
"HEAD /foldoc/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:30 +0200] 
"HEAD /cgi-bin/adcycle/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:30 +0200] 
"HEAD /ROADS/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:30 +0200] 
"HEAD /way-board/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:30 +0200] 
"HEAD /cgi-bin/a1stats/ HTTP/1.0" 404 0 "-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:30 +0200] 
"GET ///index.php?chemin=..%2F..%2F..%2F..%2F..%2F..%2Fetc HTTP/1.0" 200 8610
"-" "-"
194.29.26.126 - - [10/Sep/2002:17:48:31 +0200] 
"GET ///edit_image.php?dn=1&userfile=/etc/passwd&userfile_name=%20;ls;%20
HTTP/1.0" 404 6044 "-" "-"

 HTTP/1.0" 404 6044 "-" "-"
Come vedi la risposta e' 404.
Sarebbe comunque opportuno che tu verificassi tutti gli script php
in modo che non possano essere usati per questo genere di "verifiche".
Se hai uno script che accetta un file come parametro, controlla che
tale file *non* sia in una directory "riservata".
Davide