LinuxQuestions.org
Help answer threads with 0 replies.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 07-26-2008, 08:58 PM   #1
bizzay
LQ Newbie
 
Registered: Jul 2008
Posts: 4

Rep: Reputation: 0
Angry Someone Hacked My Webserver


When i checked my latest visitors column in the cpanel i found a robot.txt file in my webserver, it was hacked by a bot program and i found a huge list of error logs created by the bot.

HOW ON EARTH CAN I PREVENT THESE THINGS FROM HAPPENING AGAIN???????

For now i have encrypted some of the important files but i know its useless.

I need some suggestions
 
Old 07-26-2008, 09:00 PM   #2
Mr. C.
Senior Member
 
Registered: Jun 2008
Posts: 2,529

Rep: Reputation: 59
Learn how to securely configure your server and the services you run.

There isn't enough data here to recommend anything else.
 
Old 07-26-2008, 09:05 PM   #3
bizzay
LQ Newbie
 
Registered: Jul 2008
Posts: 4

Original Poster
Rep: Reputation: 0
Here i got this message in my LATEST VISITORS column, please how do i stop these things????

Host: 216.158.1.200
/robots.txt
Http Code: 404 Date: Jul 27 05:24:50 Http Version: HTTP/1.0 Size in Bytes: -
Referer: -
Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0/1.0 (bot; http://; bot@bot.com)



/
Http Code: 200 Date: Jul 27 05:24:55 Http Version: HTTP/1.0 Size in Bytes: 36048
Referer: -
Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0/1.0 (bot; http://; bot@bot.com)
 
Old 07-26-2008, 09:10 PM   #4
Mr. C.
Senior Member
 
Registered: Jun 2008
Posts: 2,529

Rep: Reputation: 59
404 means NOT FOUND. This means you DON'T have the file robots.txt (which is a file used to prevent web spiders crawling your site). Web crawlers ask your site if its OK to crawl. No robots.txt means its OK to crawl.

200 means SUCCESS. A remote site asked for /, and your server returned it.

If you are going to run a web server, learn about apache web logs and what they mean.

There is nothing abnormal here.

No go back and reread my first post.

Last edited by Mr. C.; 07-26-2008 at 09:20 PM.
 
Old 07-26-2008, 09:15 PM   #5
bizzay
LQ Newbie
 
Registered: Jul 2008
Posts: 4

Original Poster
Rep: Reputation: 0
thanx,also

And what about the error logs that i got,
 
Old 07-26-2008, 09:19 PM   #6
Mr. C.
Senior Member
 
Registered: Jun 2008
Posts: 2,529

Rep: Reputation: 59
And what about them?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Does this mean I've been hacked?? ozymandias Linux - Security 3 09-23-2005 06:05 AM
Am I being Hacked ? rizhun Linux - Security 4 09-07-2005 08:08 AM
How did my linux-apache webserver get hacked? markie Linux - Security 18 10-19-2004 08:07 PM
Was I hacked? asktoby Linux - Security 37 01-18-2004 06:51 PM
Can't see WebServer from outside... Can see WebServer locally as http://localhost friddick Linux - Networking 13 08-19-2003 06:27 PM


All times are GMT -5. The time now is 06:52 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration