Dotaz: Apache2 error_log - divné informace

[Martin]

Dobrý den,

poslední dny sleduji v error_logu pravidelně aktualizovaného Apache 2.0.54 z Debain sarge nějaké podivné informace (viz níže).
Když se ten soubor nice.txt pokusím hledat v systému přes locate, tak nejsem úspěšný.
Setkali jste se někdo s něčím podobným?
Google mi prakticky nic relevantního nenašel.

[Wed Aug 16 00:00:24 2006] [notice] Graceful restart requested, doing restart
[Wed Aug 16 00:00:33 2006] [notice] Apache configured -- resuming normal operations
--03:20:30--  http://www.geocities.com/joaolucasbr/nice.txt
           => `nice.txt'
Resolving www.geocities.com... 66.218.77.68
Connecting to www.geocities.com[66.218.77.68]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 29,776 [text/plain]

    0K .......... .......... .........                       100%   52.30 KB/s

03:20:32 (52.30 KB/s) - `nice.txt' saved [29776/29776]

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  3 29776    3  1015    0     0    166      0  0:02:59  0:00:06  0:02:53   166100 29776  100 29776    0     0   4487      0  0:00:06  0:00:06 --:--:-- 53558
[Thu Aug 17 00:00:34 2006] [notice] Graceful restart requested, doing restart
[Thu Aug 17 00:00:40 2006] [notice] Apache configured -- resuming normal operations
[Fri Aug 18 00:00:27 2006] [notice] Graceful restart requested, doing restart
[Fri Aug 18 00:00:30 2006] [notice] Apache configured -- resuming normal operations
--06:14:55--  http://www.geocities.com/joaolucasbr/nice.txt
           => `nice.txt'
Resolving www.geocities.com... 66.218.77.68
Connecting to www.geocities.com[66.218.77.68]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 29,779 [text/plain]

    0K .......... .......... .........                       100%   54.38 KB/s

06:14:56 (54.38 KB/s) - `nice.txt' saved [29779/29779]

--06:21:13--  http://www.geocities.com/joaolucasbr/nice.txt
           => `nice.txt'
Resolving www.geocities.com... 66.218.77.68
Connecting to www.geocities.com[66.218.77.68]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 29,779 [text/plain]

    0K .......... .......... .........                       100%   55.91 KB/s

06:21:14 (55.91 KB/s) - `nice.txt' saved [29779/29779]

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  3 29779    3  1015    0     0   1667      0  0:00:17 --:--:--  0:00:17  1667 47 29779   47 14047    0     0  14590      0  0:00:02 --:--:--  0:00:02 36709100 29779  100 29779    0     0  26109      0  0:00:01  0:00:01 --:--:-- 54067
--17:09:53--  http://www.geocities.com/joaolucasbr/nice.txt
           => `nice.txt'
Resolving www.geocities.com... 66.218.77.68
Connecting to www.geocities.com[66.218.77.68]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 29,779 [text/plain]

    0K .......... .......... .........                       100%   54.41 KB/s

17:09:54 (54.41 KB/s) - `nice.txt' saved [29779/29779]

--17:19:47--  http://www.geocities.com/joaolucasbr/nice.txt
           => `nice.txt.1'
Resolving www.geocities.com... 66.218.77.68
Connecting to www.geocities.com[66.218.77.68]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 29,779 [text/plain]

    0K .......... .......... .........                       100%   81.33 KB/s

17:19:48 (81.33 KB/s) - `nice.txt.1' saved [29779/29779]

--17:21:57--  http://www.geocities.com/joaolucasbr/nice.txt
           => `nice.txt.2'
Resolving www.geocities.com... 66.218.77.68
Connecting to www.geocities.com[66.218.77.68]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 29,779 [text/plain]

    0K .......... .......... .........                       100%   53.99 KB/s

17:21:58 (53.99 KB/s) - `nice.txt.2' saved [29779/29779]

--17:24:10--  http://www.geocities.com/joaolucasbr/nice.txt
           => `nice.txt.3'
Resolving www.geocities.com... 66.218.77.68
Connecting to www.geocities.com[66.218.77.68]:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 29,779 [text/plain]

    0K .......... .......... .........                       100%   51.48 KB/s

17:24:11 (51.48 KB/s) - `nice.txt.3' saved [29779/29779]

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  3 29779    3  1015    0     0   1565      0  0:00:19 --:--:--  0:00:19  1565 47 29779   47 14047    0     0  14137      0  0:00:02 --:--:--  0:00:02 37664100 29779  100 29779    0     0  25434      0  0:00:01  0:00:01 --:--:-- 54998
[Sat Aug 19 00:00:25 2006] [notice] Graceful restart requested, doing restart
[Sat Aug 19 00:00:33 2006] [notice] Apache configured -- resuming normal operations
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  3 29779    3  1015    0     0    667      0  0:00:44  0:00:01  0:00:43   667100 29779  100 29779    0     0  15511      0  0:00:01  0:00:01 --:--:-- 71910

Odpovědi

[Zdeněk Burda]

To vypadá, jako bys tam měl návštěvu a ta si tam pod apachem spouštěla své prográmky, v tomhle případě to bude asi wget pro stažení skriptu z geocities. Soubor nice.txt vůbec nemusí u tebe v systému existovat, protože ho útočník mohl spustit a smazat.

[NbS]

Rekl bych ze mas v systemu vice useru nez je zdravo :)) Nedavno jsem taky cistil system po utocnikovi (bohuzel jen cistl, nepovolili me ho reinstalovat a tak mit 100% jistotu ...) ale zpatky k tobe a) nahrad ps,top,ls a podobne programy v systemu temi svymi (pro pripad ze je utocnik pozmenil) b) omrkni jimi procesy a usery c) pokud mas zalohu tak udelej ze si to nech porovnat (je to otrocina, ale vyplati se to) - pochopitelne ta zaloha by mela byt co nejcerstvejsi :) d) procesej /proc a tmp na vyskyt toho souboru ...

ale nejlepsi co muzes (pokud muzes) udelat je nova cista instalace a pres iptables povolit jen to co potrebujes ...

[Dan Ohnesorg]

Tady iptables vuuuuuubec nepomuzou. Ani trochu. Tady nekdo sel pres php nebo diru v cgi skriptu. Dokonce pravdepodobne nedokazal nic moc napachat, kdyz po sobe ani neuklidil logy.

To chce audit aplikaci, ktere tam bezi, prekontrolovat system a overit si, ze vsechny partition, kam muze apache zapisovat, jsou mountovany s noexec a nodev. Aktualne se to objevuje na serverech, kde je starsi nezazaplatovany horde nebo drupal. Ale takovych deravych aplikaci muze byt fura.

Rozhodne tady nepomuze zadny firewall.

[NbS]

To sice ano (stejne jako kdyby uzivatel pouzil nejnovejsi verzi apache a nekdo nalezl chybu a udelal si exploit) mel jsem to napsat presneji :) Taky si ale myslim ze nebyl moc zkuseny a spis je ten www server deravej jak cednik ... takze nejjistejsi je procesat passwd,shadow a group ... pokud ma jeste nejaky ten htaccess tak i tam

[Martin]

Díky za Váš čas a rady. Prolítnu systém podle výše popsaných návodů. Pravda, že starší Horde tam je, ale snad to nebude tak strašné, když open_basedir byl nastaven na "/home/www/html/:/tmp/".

[Jakub Suchy]

To vam nepomuze. Dulezite je hlavne zakazat allow_url_fopen