Dotaz: Divne Apache logy (pokus o hack ?)

[asdzxc]

Ahoj,

dnes rano som v Apachovom error logu nasiel tieto divne veci (je tam toho kopu, uvadzam len par prikladov):

sh: line 1: /cd: No such file or directory
sh: line 1: /pwd: No such file or directory
sh: line 1: /id: No such file or directory
sh: line 1: /which: No such file or directory
sh: line 1: /crontab: No such file or directory
sh: line 1: /perl: No such file or directory
sh: line 1: /rm: No such file or directory
sh: line 1: /wget: No such file or directory
sh: line 1: /GET: No such file or directory
sh: line 1: /fetch: No such file or directory

Kazdy web ma u mna svoj vlastny error log, tento v ktorom som nasiel to hore je log, kde sa ukladaju _len_ cisto errory z Apacha (teda napr. veci ako Warning: DocumentRoot [...] does not exist).

Mam Debian Sarge, vsetky patche nainstalovane. Jediny skriptovaci jazyk je PHP.

Naloadovane su len tieto moduly (ak by sa niekto cudoval nad PHP5 v Sargeovi, tak ho mam z dotdeb.org :) nie je to original balik):
php5 rewrite ssl userdir vhost_alias.

Nejake napady ako sa to tam mohlo dostat ? Mozno nejaky non-public remote PHP/Apache bug ?

Odpovědi

[asdzxc]

nikto nic ?

[hele]

asi nemate zakazane pousteni programu v phpcku, a nekdo vam tam neco nahral bud skrz diru v nejakem portalu a nebo skrz ftp a ted zkousel co tam mate.

[hele]

taky doporucuji grepnout access logy na pozadavky ve stylu GET /xxxx.php?page=http://... ....

to pak staci zakazat allow_fopen_url ci tak nejak to je.

[asdzxc]

tak to nie, safe_mode=on . vravim ze to nebolo v logoch webov (toto co hovoris by sa objavilo v logu toho webu), bol to error log priamo apachovych chyb.

[Jan Včelák]

Radeji nez safe_mode doporucuji open_basedir a zakazat fuknce exec, system...

[asdzxc]

yo yo vdaka ale to stale nevysvetluje tie logy :)