LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 05-07-2012, 07:47 AM   #1
vitthal_jamdade
LQ Newbie
 
Registered: May 2012
Location: India
Distribution: RHEL
Posts: 8
Blog Entries: 1

Rep: Reputation: Disabled
Smile How to resolve attack done on server by some IP via httpd?


pl find below logs. can you please help me to analyse logs.

kernel: type=1400 audit(1319525689.800:13979617): avc: denied { getopt } for pid=16179 comm="httpd" laddr=209.x.x.x lport=52106 faddr=209.x.x.x fport=443 scontext=user_u:system_r:bootloader_t:s0 tcontext=user_u:system_r:bootloader_t:s0 tclass=tcp_socket

PS:IP addresses are changed for security reason.

Vitthal
 
Old 05-07-2012, 07:59 AM   #2
Slackyman
Member
 
Registered: Mar 2011
Location: Rome - Italy
Distribution: Slackware 13.1
Posts: 347

Rep: Reputation: 44
First of all make sure you have granted httpd all security permission and grants: http://wiki.eri.ucsb.edu/sysadm/SELinux#HTTPD
Second: it's possible that a script (php, cgi etc) invokes a httpd legit function that it's blocked by SELinux.
Third: a Whois of the IP Address is often useul to check if the IP Address is in some blacklist.
The strange thing is the context of httpd: "user_u:system_r:bootloader_t:s0" why httpd has bootloader context access? Maybe it's really a kind of attack trying to access boot sector or bootloader or maybe, there's a misconfiguration in httpd or the problem happens at boot time during init (?!?).

Last edited by Slackyman; 05-07-2012 at 08:17 AM.
 
1 members found this post helpful.
Old 05-07-2012, 08:15 AM   #3
vitthal_jamdade
LQ Newbie
 
Registered: May 2012
Location: India
Distribution: RHEL
Posts: 8
Blog Entries: 1

Original Poster
Rep: Reputation: Disabled
Hi Slackyman,

Thanks for reply. Can u pl tel me is it better idea to stop SElinux if the servers are protected by network firewall.

vitthal
 
Old 05-07-2012, 08:15 AM   #4
vitthal_jamdade
LQ Newbie
 
Registered: May 2012
Location: India
Distribution: RHEL
Posts: 8
Blog Entries: 1

Original Poster
Rep: Reputation: Disabled
Hi Slackyman,

Thanks for reply. Can u pl tel me is it better idea to stop SElinux if the servers are protected by network firewall.

vitthal
 
Old 05-07-2012, 08:32 AM   #5
Slackyman
Member
 
Registered: Mar 2011
Location: Rome - Italy
Distribution: Slackware 13.1
Posts: 347

Rep: Reputation: 44
I don't think that stopping SELinux is a great idea if the firewall is not well-configured.
I mean: I use Slackware without SELinux but I use iptables and my system keep a trace of any incoming and outcoming connection so that I can inspect what's happening and re-arrange my configuration but if you use Fedora or CentOS or any other distro using it I suggest you to keep it working.
 
Old 05-09-2012, 05:57 PM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,331
Blog Entries: 55

Rep: Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529Reputation: 3529
Quote:
Originally Posted by vitthal_jamdade View Post
scontext=user_u:system_r:bootloader_t:s0 tcontext=user_u:system_r:bootloader_t:s0
...looks like the wrong context to me for the web server. Should be httpd_.* AFAIK.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
vsftpd brutte force attack - how to resolve IP ? dlugasx Linux - Security 13 02-18-2009 02:56 AM


All times are GMT -5. The time now is 06:39 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration