try checking the logging section of webmin, I believe it covers that.. Its strange, I don't remember changing any settings, and my apache logs IP's only,,
rgds Frank Network Payment Solutions. To correct all M$ Windows problems, only one small command is necessary: format C: (then press y.) Bingo! Your windows computer is now secure, stable, and just as useful. For Perth Peoples: http://www.gshop.com.au For Australian e-business http://www.e-pay.net.au http://networkpaymentsolutions.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Newbie Sent: Saturday, 6 October 2001 4:05 AM To: [EMAIL PROTECTED] Subject: Re: [newbie] We hate "GET /scripts/..%c0%af../winnt/system32/cmd.exe? Ok. Fine enough. That means my server is stuck in 'hostname' mode, and I can't get it to stop it, how do I make linuxconf go back to logging with just the ip addresses then? It is disobeying my direct orders to not use hostnames. On Friday 05 October 2001 02:12 pm, you wrote: > keep this in mind, domain names were created to provide a human friendly > use of ip address's > > servers don't care about hostnames, if you tell it to work with one, it > will just go and look it up to get the IP address... > > so if you want things to go faster, you should eliminate the lookup > phase... and just stick with the IP address's > > if you want to resolve all those IP's back to hostnames so you can try to > contact them,, don't bother, nobodies listening on most of them, most of > them are servers that are not even supposed to be running a web server and > the admins don't even know they are, if you go to them, you will find more > often then not, that its a default NT/2000 IIS "congrates, IIS is working" > page... I tried doin it (contacting them,) gave up after a few hours...and > never got a single thankyou or any other response from any of the hundred > or so emails I did find. > > If you really are interested in getting the hostnames, then write a script > that opens that blocked file, parses it and does a reverse dns on it, and > prints the results to blocked-hostnames or something.. > > that way you are only doing the DNS when you want them, rather then > whenever the nimda script is run from crontab > > The reason I wanted this script in the first place, is because I want to > cut down the bandwidth these servers were wasting... > > doing dns lookups on all of them would be a waste of bandwidth to make the > matter worse. > > > > > > rgds > > Frank > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Newbie > Sent: Saturday, 6 October 2001 2:53 AM > To: [EMAIL PROTECTED] > Subject: Re: [newbie] We hate "GET > /scripts/..%c0%af../winnt/system32/cmd.exe? > > > Got the script to run, now how do you get > your logger back to logging ip addresses instead > of hostnames, or make /bin/nimda log hostnames > instead, or would that confuse ipchains? > > Thanks for all you done so far. > > On Friday 05 October 2001 12:00 pm, you wrote: > > welcome to Nimda, the cleaning agent of windows IIS servers, (also known > > as > > > a worm/virus) > > > > this is a feature of windows designed to facilitate the accumulation of > > zombie servers for hackers the world over. > > every nimda infected server spends its days broadcasting itself to the > > internet at large by trying to find other servers to hack.. > > > > I have a shell script here that I got from someone (possibly here, or > > possibly the snort list, can't remember) > > This script goes though your httpd logs looking for lines like those > > below, > > > and creates ipchains rules to block them.. > > (this could be easily converted to IPTABLES rules for anyone that wants > > to.. ) > > > > all you need to do is copy it to a file on your system (I called mine > > nimda > > > as I figured that was appropraite), make it executable, then make a file > > called "blocked" in /var/tmp (type: touch /var/tmp/blocked ) > > > > Then use crontab to run the script regurlarly, (the more often the less > > traphic you will get from infected servers) > > I run mine every 5 minutes, but I have a 1.4 gig so you may choose less > > then that... > > > > Thats it,, it will scan the logs, keep the IP of any boxes asking for > > cmd.exe root.exe Admin.dll and default.ida and add the ip to > > /var/tmp/blocked as well as creating a ipchain rule to block the server > > from scanning you... > > > > (The blocked file, is there so that your server doesn't try to block the > > same servers more then once. if the IP is in /var/tmp/blocked, it is > > assumed to be already blocked so no action is taken. > > > > rgds > > > > > > Frank > > > > Here is the Script... (Its messy, but it works..) > > ================================================== > > > > #!/bin/sh > > # > > # Block sites which originate Nimba queries from Apache server > > # Apache must be configured with HostnameLookups Off > > > > LOGS=/var/log/httpd > > > > cd $LOGS > > > > grep '^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* ' * 2>/dev/null | > > awk '/system32\/cmd\.exe/ {sub(/[^:]*:/,"");print $1}' | > > sort -u | > > while read host > > do > > if ! fgrep $host /var/tmp/blocked >/dev/null > > then > > echo $host >>/var/tmp/blocked > > /sbin/ipchains -I input -s $host -j DENY -l > > fi > > done > > # Block sites which originate Nimba queries from Apache server > > # Apache must be configured with HostnameLookups Off > > > > #LOGS=/var/log/httpd > > > > #cd $LOGS > > > > grep '^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* ' * 2>/dev/null | > > awk '/scripts\/Admin\.dll/ {sub(/[^:]*:/,"");print $1}' | > > sort -u | > > while read host > > do > > if ! fgrep $host /var/tmp/blocked >/dev/null > > then > > echo $host >>/var/tmp/blocked > > /sbin/ipchains -I input -s $host -j DENY -l > > fi > > done > > > > grep '^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* ' * 2>/dev/null | > > awk '/MSACD\/Admin\.dll/ {sub(/[^:]*:/,"");print $1}' | > > sort -u | > > while read host > > do > > if ! fgrep $host /var/tmp/blocked >/dev/null > > then > > echo $host >>/var/tmp/blocked > > /sbin/ipchains -I input -s $host -j DENY -l > > fi > > done > > > > grep '^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* ' * 2>/dev/null | > > awk '/scripts\/root\.exe/ {sub(/[^:]*:/,"");print $1}' | > > sort -u | > > while read host > > do > > if ! fgrep $host /var/tmp/blocked >/dev/null > > then > > echo $host >>/var/tmp/blocked > > /sbin/ipchains -I input -s $host -j DENY -l > > fi > > done > > > > grep '^[0-9]*\.[0-9]*\.[0-9]*\.[0-9]* ' * 2>/dev/null | > > awk '/default\.ida/ {sub(/[^:]*:/,"");print $1}' | > > sort -u | > > while read host > > do > > if ! fgrep $host /var/tmp/blocked >/dev/null > > then > > echo $host >>/var/tmp/blocked > > /sbin/ipchains -I input -s $host -j DENY -l > > fi > > done > > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED]]On Behalf Of Newbie > > Sent: Saturday, 6 October 2001 12:38 AM > > To: [EMAIL PROTECTED] > > Subject: [newbie] We hate "GET > > /scripts/..%c0%af../winnt/system32/cmd.exe? > > > > > > What is up with this? > > > > adsl-64-217-74-189.dsl.austtx.swbell.net - - [05/Oct/2001:11:03:37 -0500] > > "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 324 > > "-" "-" > > adsl-64-217-74-189.dsl.austtx.swbell.net - - [05/Oct/2001:11:03:37 -0500] > > "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 324 > > "-" "-" > > adsl-64-217-74-189.dsl.austtx.swbell.net - - [05/Oct/2001:11:03:37 -0500] > > "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 324 > > "-" "-" > > > > How do I block these boogerbutts out > > of my server? > > > > I hate them, would some kind person please > > tell me how to block them out? > > > > I would be very grateful.
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
