[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Advice needed, trying to find the vulnerable code on Debian webserver.

On Wed, Jun 16, 2004 at 11:44:17AM -0500, Micah Anderson wrote:
> > > 
> > > Install some rules for it to harden your webserver, see if anything is 
> > > flagged in the security log.
> > 
> > other web server testing tools
> > 	http://www.linux-sec.net/Web/#Testing
> Has anyone actually used any of these to find the vulnerabilities that
> are being discussed? 

  Not personally, I've used snort and some other custom logging code 
 to find exploit attempts in real time though.

  Can you tell us what CGI apps are installed upon the box?  Or
 do the access logs should anything suspicious?  It's clear that
 Apache is the route into the system if you have files owned by
 www-data - maybe mounting /tmp noexec would help?

  (note: mounting /tmp noexec breaks apt often).

# The Debian Security Audit Project.

Reply to: