Re: Debian Investigation Report after Server Compromises
On Thu, 04 Dec 2003 18:05:15 -0800, Vineet Kumar wrote:
> * Paul Morgan (paulswm@earthlink.net) [031204 12:32]:
>> I have all services locked down to localhost; my only connections to
>> the outside world are mail, news via nntpcached, web via squid... I run
>> Apache but it too is locked down to localhost. My mail is run through my
>
> this ...
>
>> ISP's (earthlink's) virus and spam filters before I get it (otherwise I'd
>> be getting like 10 Svens per day). I do see, from time to time, Apache
>> refusing connections attempts which are generally attacks by Windoze worms.
>
> ... and this do not add up. Methinks your apache is not "locked down to
> localhost."
>
150.140.128.174 - - [03/Dec/2003:08:52:40 -0500] "GET
/.hash=0df2df7b5aeac6aabb9ad2e00c0d150f831fffff HTTP/1.1" 403 322 "-" "-"
[Wed Dec 3 08:52:40 2003] [error] [client 150.140.128.174] client denied by server configuration: /var/www/.hash=0df2df7b5aeac6aabb9ad2e00c0d150f831fffff
--
....................paul
"The number of UNIX installations has grown to 10, with more expected."
(The UNIX Programmer's Manual, 2nd Edition, June 1972)
Reply to: