Hello!

I have just started using my pc as a server. I run Apache under Mandrake 8.1

I have a concern about security: opening my log file, I noticed several "attempts", as the following:

==
"GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 321 "-" "-"
"GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 321 "-" "-"
"GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 335 "-" "-"
"GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
"GET /_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
"GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system
"GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 334 "-" "-"
"GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 334 "-" "-"
==

Can you tell me which is the easisest way to avoid this attempts....?

Thanks in advance!

Marco

Well, if it is what it looks like and someone is trying to use get to execute the cmd.exe command to do something on your system, then you wanna setup a firewall if you don't have one so people can't find or use any open ports.

Thanks!

I have installed the 'standard' firewall included into the Mandrake distribution. My (newbie) question is : since the quoted attempt are continuing (I guess it's an automati procedure), can I feel a bit more secure with the firewall working? Shoud I do something else to protect my site?

Thanks in advance,

Marco

If it is some automated task, i'd find out what it is just to make myself feel better. As for a firewall, ANY type of firewall is better than nothing, so yeah, i'd feel better. It depends on how secure you wanna feel as to what you setup for a firewall though.

Marcoc,

The messages in your log are indicative of a scan by the Nimda worm, which is probing for MS IIS servers. Since you're running Apache on Linux, there's no threat to your machine.

Many thanks to all for your kind replies

I'd have another question: is it possible to tell the system not to write those access to "access_log" , in order to leave the file "clean"? (just happy if you can point me to some docs..)

Marco

i get shit loads of those in my logs daily. Nothing to worry about the scipt kiddie thinks your running iis

There might be (probably is) a way, but off the top of my head I don't know...

#!/bin/sh
# this script is /usr/sbin/clearlogtext
# courtesy of comp.os.linux.security
# YMMV
if [ $# != 2 ] ; then
echo "syntax: $0 logfile text"
echo "example: /usr/sbin/clearlogtext /var/log/httpd/access_log \.exe"
else
awk !/$2/{print} $1 > t;>$1;cat t > $1; rm t
fi