From owner-freebsd-security Sat Jan 26 9:23:44 2002 Delivered-To: freebsd-security@freebsd.org Received: from jgj.org.uk (public1-leed1-4-cust166.leed.broadband.ntl.com [80.0.0.166]) by hub.freebsd.org (Postfix) with SMTP id F1F4A37B402 for ; Sat, 26 Jan 2002 09:23:36 -0800 (PST) Received: (qmail 81900 invoked from network); 26 Jan 2002 17:25:20 -0000 Received: from sean.jgj.org.uk (192.168.243.89) by rufus.jgj.org.uk with SMTP; 26 Jan 2002 17:25:20 -0000 Date: Sat, 26 Jan 2002 17:23:35 +0000 Subject: Re: weird server activity Content-Type: text/plain; charset=US-ASCII; format=flowed Mime-Version: 1.0 (Apple Message framework v480) From: James Jeffrey To: freebsd-security@freebsd.org Content-Transfer-Encoding: 7bit In-Reply-To: Message-Id: <6DBE5096-1281-11D6-B090-003065A1F05E@jgj.org.uk> X-Mailer: Apple Mail (2.480) Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Hi, As a very low grade FreeBSD'ian I'm ready to get shot down in flames here but... I think the logs are a red herring, its just various attempts to exploit IIS which wont effect you, I get them all the time. This dosen't really sound like a security problem as such, I suppose it could be some kind of DoS, but from my limited experience it is more likely to be leaky software and your running out of memory or something. Does your website have any active content? Any cgi-scripts or the like that could be generating problems? I have seen similar symptoms on Solaris webserves that were caused by badly written web-backend software exhausting the virtual memory, and I once wrote a cgi-script which did much the same to a FreeBSD box..... :( regards, James Jeffrey (CCSA, CCSE) james@jgj.org.uk On Saturday, January 26, 2002, at 05:13 , William J. Borskey wrote: > I am running FreeBSD 4.4. I use Apache-fp and openssh. About a week ago > my system went down and I wasnt > able to log in or look at any web pages. I could connect, but it woud > not spawn a process to log me in, or serve me a > web document. I got someone to reboot the machine from the console, I > was then able to log into the machine. > Starting processes was slow but top reports normal system loads. Then > after about an hour the machine would no > longer run any processes and quickly shut me out by killing the sshd i > was connected with. I did get a chance to > look at some of my logs, not all unfortuantly. The httpd-access file > had some weird sequences of windows > sounding paths, but it wasnt code red or anything like code red: > 147.46.54.38 - - [19/Jan/2002:15:12:57 -0600] "GET > /scripts/root.exe?/c+dir HTTP/1.0" 404 200 > 147.46.54.38 - - [19/Jan/2002:15:12:57 -0600] "GET > /scripts/root.exe?/c+dir HTTP/1.0" 404 200 "-" "-" > > 147.46.54.38 - - [19/Jan/2002:15:12:57 -0600] "GET > /MSADC/root.exe?/c+dir > 147.46.54.38 - - [19/Jan/2002:15:12:58 -0600] "GET > > /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 > 200 "-" "-" > i havnt been able to look at any other logs and i doubt that that has > anything to do with it. > > William Borskey > > _________________________________________________________________ > Get your FREE download of MSN Explorer at > http://explorer.msn.com/intl.asp. > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message