IWETHEY v. 0.3.0 | TODO
1,095 registered users | 0 active users | 0 LpH | Statistics
Login | Create New User
IWETHEY Banner

Welcome to IWETHEY!

IWETHEY Home / IWETHEY Board / Suggestions Forum / Re: That explains my apache error log.
Post #238,423
by Yendor
12/17/05 11:03:49 AM
Reply
New Re: That explains my apache error log.
Snippets from the Apache 1.3.34-1 error log for my main domain:
[Tue Dec  6 07:34:55 2005] [error] [client 80.81.122.177] File does not exist: /usr/www/mikevitale/awstats/awstats.pl\n[Tue Dec  6 07:34:57 2005] [error] /usr/www/mikevitale/cgi-bin/awstats.pl not found or unable to stat\n[Tue Dec  6 07:34:58 2005] [error] [client 80.81.122.177] script not found or unable to stat: /usr/www/mikevitale/cgi-bin/awstats\n[Tue Dec  6 07:35:00 2005] [error] [client 80.81.122.177] File does not exist: /usr/www/mikevitale/xmlrpc.php\n[Tue Dec  6 07:35:02 2005] [error] [client 80.81.122.177] File does not exist: /usr/www/mikevitale/blog/xmlrpc.php\n[Tue Dec  6 07:35:03 2005] [error] [client 80.81.122.177] File does not exist: /usr/www/mikevitale/blog/xmlsrv/xmlrpc.php\n[Tue Dec  6 07:35:04 2005] [error] [client 80.81.122.177] File does not exist: /usr/www/mikevitale/blogs/xmlsrv/xmlrpc.php\n[Tue Dec  6 07:35:05 2005] [error] [client 80.81.122.177] File does not exist: /usr/www/mikevitale/drupal/xmlrpc.php\n[Tue Dec  6 07:35:07 2005] [error] [client 80.81.122.177] File does not exist: /usr/www/mikevitale/phpgroupware/xmlrpc.php\n[Tue Dec  6 07:35:08 2005] [error] [client 80.81.122.177] File does not exist: /usr/www/mikevitale/wordpress/xmlrpc.php\n[Tue Dec  6 07:35:09 2005] [error] [client 80.81.122.177] File does not exist: /usr/www/mikevitale/xmlrpc.php\n[Tue Dec  6 07:35:10 2005] [error] [client 80.81.122.177] File does not exist: /usr/www/mikevitale/xmlrpc/xmlrpc.php\n[Tue Dec  6 07:35:12 2005] [error] [client 80.81.122.177] File does not exist: /usr/www/mikevitale/xmlsrv/xmlrpc.php\n[Sun Dec 11 13:45:36 2005] [error] [client 65.203.134.100] File does not exist: /usr/www/mikevitale/webcalendar/tools/send_reminders.php\n[Sun Dec 11 13:45:37 2005] [error] [client 65.203.134.100] File does not exist: /usr/www/mikevitale/WebCalendar/tools/send_reminders.php\n[Sun Dec 11 13:45:37 2005] [error] [client 65.203.134.100] File does not exist: /usr/www/mikevitale/cacti/include/config_settings.php\n[Sun Dec 11 13:45:37 2005] [error] [client 65.203.134.100] File does not exist: /usr/www/mikevitale/calendar/tools/send_reminders.php\n[Sun Dec 11 13:45:38 2005] [error] [client 65.203.134.100] File does not exist: /usr/www/mikevitale/webcalendar/ws/get_reminders.php\n[Sun Dec 11 13:45:38 2005] [error] [client 65.203.134.100] File does not exist: /usr/www/mikevitale/WebCalendar/ws/get_reminders.php\n[Sun Dec 11 13:45:38 2005] [error] [client 65.203.134.100] File does not exist: /usr/www/mikevitale/calendar/ws/get_reminders.php\n[Sun Dec 11 13:45:39 2005] [error] [client 65.203.134.100] File does not exist: /usr/www/mikevitale/events/tools/send_reminders.php\n[Thu Dec 15 11:02:22 2005] [error] [client 195.250.24.66] File does not exist: /usr/www/mikevitale/index2.php\n[Thu Dec 15 11:02:23 2005] [error] [client 195.250.24.66] File does not exist: /usr/www/mikevitale/index.php\n[Thu Dec 15 11:02:25 2005] [error] [client 195.250.24.66] File does not exist: /usr/www/mikevitale/mambo/index2.php\n[Thu Dec 15 11:02:26 2005] [error] [client 195.250.24.66] File does not exist: /usr/www/mikevitale/cvs/mambo/index2.php
Dunno if that provides any insight, but more information never hurts...
-YendorMike

"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."
- Benjamin Franklin, 1759 Historical Review of Pennsylvania
Post #238,447
by boxley
12/17/05 7:01:10 PM
Reply
New probably a script trying the following
[link|http://www.html4.com/mime/markup/php/how_to_en/how_to_system_en/how_to_system_4.php|http://www.html4.com...w_to_system_4.php]

IN THE FOLLOWING LINES, THE SPAMMER HAS TRIED TO PASS ORDERS TO THE AWSTATS PROGRAM.
SEE THE .htaccess FILE TO BLOCK THE "DataCha0s/2.0" USER-AGENT STRING.
131.220.68.66 - - [04/Aug/2005:22:24:17 +0200] "GET /awstats/awstats.pl?configdir=|echo;echo;id;%00 HTTP/1.0" 404 176125 "-" "DataCha0s/2.0"
131.220.68.66 - - [04/Aug/2005:22:24:26 +0200] "GET /cgi-bin/awstats.pl?configdir=|echo;echo;id;%00 HTTP/1.0" 404 1725 "-" "DataCha0s/2.0"
131.220.68.66 - - [04/Aug/2005:22:24:16 +0200] "GET /cgi-bin/awstats/awstats.pl?configdir=|echo;echo;id;%00 HTTP/1.0" 404 1725 "-" "DataCha0s/2.0"
"the reason people don't buy conspiracy theories is that they think conspiracy means everyone is on the same program. Thats not how it works. Everybody has a different program. They just all want the same guy dead. Socrates was a gadfly, but I bet he took time out to screw somebodies wife" Gus Vitelli

Any opinions expressed by me are mine alone, posted from my home computer, on my own time as a free american and do not reflect the opinions of any person or company that I have had professional relations with in the past 49 years. meep
questions, help? [link|mailto:pappas@catholic.org|email pappas at catholic.org]
Post #238,448
by admin
Picture of admin
12/17/05 7:03:01 PM
Reply
New Well, whatever the reason...
I'd think that preventing spamd from starting 7000 processes would be a good thing...
Regards,

-scott anderson

"Welcome to Rivendell, Mr. Anderson..."
Post #238,450
by boxley
12/17/05 8:07:59 PM
Reply
New turn off sendmail and spamd till issue found
"the reason people don't buy conspiracy theories is that they think conspiracy means everyone is on the same program. Thats not how it works. Everybody has a different program. They just all want the same guy dead. Socrates was a gadfly, but I bet he took time out to screw somebodies wife" Gus Vitelli

Any opinions expressed by me are mine alone, posted from my home computer, on my own time as a free american and do not reflect the opinions of any person or company that I have had professional relations with in the past 49 years. meep
questions, help? [link|mailto:pappas@catholic.org|email pappas at catholic.org]
Post #238,486
by folkert
Picture of folkert
12/18/05 6:15:32 PM
Reply
New It is not spamd with 7K pids.
it is the direct calling of "sendmail" and alias to exim4 with user perms, that is causing the unhealthy load.
--
[link|mailto:greg@gregfolkert.net|greg],
[link|http://www.iwethey.org/ed_curry|REMEMBER ED CURRY!] @ iwethey
Freedom is not FREE.
Yeah, but 10s of Trillions of US Dollars?
SELECT * FROM scog WHERE ethics > 0;

0 rows returned.
Post #238,495
by static
Picture of static
12/18/05 7:02:55 PM
Reply
New That has a familiar look.
I can't fish it out now, but there were a lot of attempts to xmlrpc.php, like you have there. So we know it's the same type of attack. :-)

I checked my email logs and there were no mass-outbound emails, so they never got in to do that.

Wade.
"Insert crowbar. Apply force."
     Z's *really* sluggish for me - elsewhere's OK. Something up? -NT - (Another Scott) - (22) - Dec. 15, 2005, 04:59:55 PM EST
         Ditto here. -NT - (a6l6e6x) - (3) - Dec. 15, 2005, 05:09:12 PM EST
             That...makes...three...of...us......... -NT - (jb4) - (2) - Dec. 15, 2005, 05:40:28 PM EST
                 Everything is sluggish for me - (bepatient) - (1) - Dec. 15, 2005, 06:05:52 PM EST
                     Yup, even my RFC-1149g pigeons have slack-wing today :( -NT - (Ashton) - Dec. 15, 2005, 06:22:56 PM EST
         nailed by spamd - (Yendor) - (17) - Dec. 15, 2005, 05:58:21 PM EST
             ouch. - (Steve Lowe) - Dec. 15, 2005, 07:25:53 PM EST
             virilent Sobor making the rounds, hotmail on its knees -NT - (boxley) - Dec. 15, 2005, 10:24:44 PM EST
             Could bird flu be mutated Windoze? - (Ashton) - Dec. 16, 2005, 12:14:50 AM EST
             There is an undiscovered by me... - (folkert) - (13) - Dec. 16, 2005, 11:30:16 PM EST
                 can you post/send associated data of a "sent" email please? -NT - (boxley) - (2) - Dec. 16, 2005, 11:32:00 PM EST
                     Maybe tomorrow. -NT - (folkert) - (1) - Dec. 16, 2005, 11:44:33 PM EST
                         we are seeing a large push of stuff at the moment - (boxley) - Dec. 17, 2005, 12:17:58 AM EST
                 That explains my apache error log. - (static) - (6) - Dec. 17, 2005, 07:05:56 AM EST
                     Re: That explains my apache error log. - (Yendor) - (5) - Dec. 17, 2005, 11:03:49 AM EST
                         probably a script trying the following - (boxley) - (3) - Dec. 17, 2005, 07:01:10 PM EST
                             Well, whatever the reason... - (admin) - (2) - Dec. 17, 2005, 07:03:01 PM EST
                                 turn off sendmail and spamd till issue found -NT - (boxley) - Dec. 17, 2005, 08:07:59 PM EST
                                 It is not spamd with 7K pids. - (folkert) - Dec. 18, 2005, 06:15:32 PM EST
                         That has a familiar look. - (static) - Dec. 18, 2005, 07:02:55 PM EST
                 In the meantime... - (admin) - (2) - Dec. 17, 2005, 06:23:32 PM EST
                     It already is being limited. (And problems fixed) - (folkert) - (1) - Dec. 18, 2005, 06:18:55 PM EST
                         Thankee sai. -NT - (Another Scott) - Dec. 18, 2005, 07:24:48 PM EST

Let's ask the Magic Conch Shell!
67 ms