Re: ¿Intrusos en mi servidor?
Perdon por el doblete... pero me falto agregarte las reglas que tengo...
con eso me lo evito...
SetEnvIf Request_URI "/winnt/system32/cmd.exe" nimda
SetEnvIf Request_URI "/scripts/root.exe" nimda
SetEnvIf Request_URI "/MSADC/root.exe" nimda
SetEnvIf Request_URI "/.." nimda
SetEnvIf Request_URI "../" nimda
CustomLog "|exec sh" "/sbin/iptables -I INPUT -s %a -j DROP" env=nimda
Saludos !
Tony
Mexico
----- Original Message -----
From: Luis M. González
To: Debian Users Spanish List
Sent: Tuesday, May 21, 2002 2:59 PM
Subject: ¿Intrusos en mi servidor?
¡Hol@ a todos!
¿Será que alguien estará tratando de hackear mi máquina?
En el archivo log de apache hay una larga lista de errores 404:
/********************************************/
[Tue May 21 15:38:25 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Tue May 21 15:38:27 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/msadc/..%5c../..%5c../..%5c/..Á ../..Á ../..Á ../winnt/s
ystem32/cmd.exe
[Tue May 21 15:38:28 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/scripts/..Á ../winnt/system32/cmd.exe
[Tue May 21 15:38:30 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/scripts/..À¯../winnt/system32/cmd.exe
[Tue May 21 15:38:31 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/scripts/..Áo../winnt/system32/cmd.exe
[Tue May 21 15:38:35 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/scripts/..%5c../winnt/system32/cmd.exe
[Tue May 21 15:38:36 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/scripts/..%2f../winnt/system32/cmd.exe
[Tue May 21 15:42:01 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/scripts/root.exe
[Tue May 21 15:42:05 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/MSADC/root.exe
[Tue May 21 15:42:08 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/c/winnt/system32/cmd.exe
[Tue May 21 15:42:12 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/d/winnt/system32/cmd.exe
[Tue May 21 15:42:15 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/scripts/..%5c../winnt/system32/cmd.exe
[Tue May 21 15:42:18 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Tue May 21 15:42:21 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe
[Tue May 21 15:42:24 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/msadc/..%5c../..%5c../..%5c/..Á ../..Á ../..Á ../winnt/s
ystem32/cmd.exe
[Tue May 21 15:42:27 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/scripts/..Á ../winnt/system32/cmd.exe
[Tue May 21 15:42:34 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/scripts/..À¯../winnt/system32/cmd.exe
[Tue May 21 15:42:37 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/scripts/..Áo../winnt/system32/cmd.exe
[Tue May 21 15:42:47 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/scripts/..%5c../winnt/system32/cmd.exe
[Tue May 21 15:42:50 2002] [error] [client 200.67.7.97] File does not exist:
/var/www/html/pn713/scripts/..%2f../winnt/system32/cmd.exe
/********************************************/
Al parecer están tratando de entrar a un sistema de M$ Windows NT con no sé
que finalidad.
¿Alguien sabe de que se trata? ¿Cómo puedo bloquear esa "búsqueda? La
dirección IP varia con el día.
Saludos
Luis Manuel
--
To UNSUBSCRIBE, email to debian-user-spanish-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact
listmaster@lists.debian.org
--
To UNSUBSCRIBE, email to debian-user-spanish-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Reply to: