Dear All,

I have just set up my FC box to be a webserver (latest updates insatlled). In my logwatch entry I get the followin messages, have I been hacked already??? Any help is appreciated...

--------------------- httpd Begin ------------------------


Requests with error response codes
401 Unauthorized
/phpMyAdmin-2.7.0-pl1/: 4 Time(s)
/phpMyAdmin-2.7.0-pl1/db_details_structure ... utf8_general_ci: 2 Time(s)
/phpMyAdmin-2.7.0-pl1/left.php?&server=1&d ... utf8_general_ci: 2 Time(s)
404 Not Found
/articles/mambo/index2.php?_REQUEST[option ... cho%20YYY;echo|: 2 Time(s)
/blog/xmlrpc.php: 2 Time(s)
/blog/xmlsrv/xmlrpc.php: 2 Time(s)
/blogs/xmlsrv/xmlrpc.php: 2 Time(s)
/cvs/index2.php?_REQUEST[option]=com_conte ... cho%20YYY;echo|: 2 Time(s)
/cvs/mambo/index2.php?_REQUEST[option]=com ... cho%20YYY;echo|: 2 Time(s)
/drupal/xmlrpc.php: 2 Time(s)
/index2.php?option=com_content&do_pdf=1&id ... cho%20YYY;echo|: 2 Time(s)
/mambo/index2.php?_REQUEST[option]=com_con ... cho%20YYY;echo|: 2 Time(s)
/phpgroupware/xmlrpc.php: 2 Time(s)
/wordpress/xmlrpc.php: 2 Time(s)
/xmlrpc.php: 3 Time(s)
/xmlrpc/xmlrpc.php: 1 Time(s)
/xmlsrv/xmlrpc.php: 1 Time(s)
405 Method Not Allowed
/wwwdir: 3 Time(s)
503 Service Unavailable
/moodle/: 1 Time(s)

---------------------- httpd End -------------------------

have I been hacked already
The reported lines are probes for software with known vulnerabilities like PHP's XMLRPC handling. If you don't run any of that software, or if you *made sure* you run *verified safe* versions (updated to latest), these probes should not have been successful, and the 4xx and 5xx errorcodes provide positive indication of that. This does not mean there are other vectors of attack (for instance because it does not get reported). Please make sure your host is hardened properly, you update your software regularly, audit the box regularly and that have accessable software properly ACL'ed (daemon configs, Xinetd, TCP wrappers, firewall) where applicable.

Please check out the LQ FAQ: Security references for more.

I do run phpMyAdmin-2.7.0-pl1 where can I find out the IP for this unauthorized entry (it may have been me)

Thx 4 the help