Hi!
On Sat, Sep 27, 2008 at 03:42:33PM +0300, Alex Efros wrote:
> Can you please explain to me what these records in my logs mean?
>
> 2008-09-27_11:35:55.93144 kern.alert: grsec: From 78.53.3.223: denied
> resource overstep by requesting 180883456 for RLIMIT_STACK against limit
> 8388608 for /bin/cat[cat:10111] uid/euid:81/81 gid/egid:81/81, parent
> /usr/sbin/apache2[apache2:21930] uid/euid:81/81 gid/egid:81/81
>
> 2008-09-27_12:08:17.12634 kern.alert: grsec: denied resource overstep by
> requesting 187367424 for RLIMIT_STACK against limit 8388608 for
> /var/qmail/bin/qmail-local[qmail-local:22538] uid/euid:1000/1000
> gid/egid:100/100, parent /var/qmail/bin/qmail-local[qmail-local:22535]
> uid/euid:1000/1000 gid/egid:100/100
Is my question too complex and nobody know the answer (or even guesses),
or it's too stupid and everybody wait until I try google (I've tried it
already, without success)?
Is last days I also notice new alert type in log:
2008-09-29_15:14:14.47478 kern.alert: grsec: From 78.129.196.12: denied
resource overstep by requesting 227184640 for RLIMIT_AS against
limit 16000000 for /var/qmail/bin/qmail-smtpd[qmail-smtpd:6545]
uid/euid:201/201 gid/egid:200/200, parent
/usr/bin/tcpserver[tcpserver:17002] uid/euid:201/201
gid/egid:200/200
This type of alerts arise after I added simple perl script, between
tcpserver and qmail-smtpd, which do greylisting. And, again, these alerts
doesn't affect server - I mean, everything works fine, no mail lost, etc.
--
WBR, Alex.
