You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by mgarriss <mg...@earthlink.net> on 2003/08/29 02:40:50 UTC
[users@httpd] blocking one address
How can I block requests from a certain ip in Apache? There is some
virus (I think) bombarding me with requests for many different things.
Some examples (cut times to avoid wrapping, but this group was all
within about 2 secs):
68.52.102.47 "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 -
68.52.102.47 "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 -
68.52.102.47 "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 -
68.52.102.47 "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 -
68.52.102.47 "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 226
68.52.102.47 "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 226
68.52.102.47 "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 -
68.52.102.47 "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 -
Luckily I'm not running NT. I suppose a better idea would be to block
this address from iptables. Any hints on how to do either of these things?
Another question: I get the /default.ida (Code Red II virus) requests a
lot but from far too many different ips to making blocking the addresses
a solution. I was returning my 404 page at about 250 bytes each time so
I just made a 0 length default.ida, not 0 bytes get returned. However I
can't do that in this case, anyway to tell apache to return 0 bytes when
somethings looks for, say, the /scripts dir (which I don't have/need).
TIA
Michael
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] blocking one address
Posted by Leif W <wa...@usa.net>.
----- Original Message -----
From: "Jason (Spaz)" <Ha...@comcast.net>
To: <us...@httpd.apache.org>
Sent: Friday, August 29, 2003 2:16 PM
Subject: RE: [users@httpd] blocking one address
> When I get back in about 3 hours I will try out this on my server. I'm
> running WinXP and Apache 2.047. My logs have been full of nothing but
> useless junk like this...so I've got to try something myself. I will let
ya
About the logs, I think these viruses scan IP ranges. For this case, I have
set up a "default" virtual host that will "catch" anything that doesn't
match any of my virtual hosts. This helps to keep the junk out of my other
site's logfiles. This is a small home-based setup with one IP. For larger
sites, each IP would have to be setup with a "default". It may clutter the
config file, but it may also separate some of the junk from logs. For each
NameVirtualHost I have the first VirtualHost section with a ServerName
default. If I access the server by IP address, I get the "default" site's
webpage.
Leif
> know unless someone else does before me.
>
> later
>
> j
>
> -----Original Message-----
> From: mgarriss [mailto:mgarriss@earthlink.net]
> Sent: Friday, August 29, 2003 10:13
> To: users@httpd.apache.org
> Subject: Re: [users@httpd] blocking one address
>
>
> Leif W wrote:
>
> >>----- Original Message -----
> >>From: Daniel Wilson
> >>To: users@httpd.apache.org
> >>Sent: Friday, August 29, 2003 9:58 AM
> >>Subject: Re: [users@httpd] blocking one address
> >>
> >>When you say, "isn't a windoze web server", do you mean that I should
> >>not use this patch? if I am using a quote windoze web Server.
(Currently
> >>I have Win XP running Apache2 (2..0.47)).
> >>
> >>
> >
> >I don't see what difference it would make, as it's a simple Redirect or
> >RedirectMatch, which works just as well in Apache for windows as other
> OSes.
> >Anyone have any explanation why this wouldn't work?
> >
>
> I think 'Mike' was just saying that he does not know if it will work on
> windows. I've applied this strategy on my site (apache2/gnu/linux) and
> it works great. I do not see any reason it would not work on windows.
> Can any one confirm this with a real test?
>
> Michael
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] blocking one address
Posted by "Jason (Spaz)" <Ha...@comcast.net>.
When I get back in about 3 hours I will try out this on my server. I'm
running WinXP and Apache 2.047. My logs have been full of nothing but
useless junk like this...so I've got to try something myself. I will let ya
know unless someone else does before me.
later
j
-----Original Message-----
From: mgarriss [mailto:mgarriss@earthlink.net]
Sent: Friday, August 29, 2003 10:13
To: users@httpd.apache.org
Subject: Re: [users@httpd] blocking one address
Leif W wrote:
>>----- Original Message -----
>>From: Daniel Wilson
>>To: users@httpd.apache.org
>>Sent: Friday, August 29, 2003 9:58 AM
>>Subject: Re: [users@httpd] blocking one address
>>
>>When you say, "isn't a windoze web server", do you mean that I should
>>not use this patch? if I am using a quote windoze web Server. (Currently
>>I have Win XP running Apache2 (2..0.47)).
>>
>>
>
>I don't see what difference it would make, as it's a simple Redirect or
>RedirectMatch, which works just as well in Apache for windows as other
OSes.
>Anyone have any explanation why this wouldn't work?
>
I think 'Mike' was just saying that he does not know if it will work on
windows. I've applied this strategy on my site (apache2/gnu/linux) and
it works great. I do not see any reason it would not work on windows.
Can any one confirm this with a real test?
Michael
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] blocking one address
Posted by mgarriss <mg...@earthlink.net>.
Leif W wrote:
>>----- Original Message -----
>>From: Daniel Wilson
>>To: users@httpd.apache.org
>>Sent: Friday, August 29, 2003 9:58 AM
>>Subject: Re: [users@httpd] blocking one address
>>
>>When you say, "isn't a windoze web server", do you mean that I should
>>not use this patch? if I am using a quote windoze web Server. (Currently
>>I have Win XP running Apache2 (2..0.47)).
>>
>>
>
>I don't see what difference it would make, as it's a simple Redirect or
>RedirectMatch, which works just as well in Apache for windows as other OSes.
>Anyone have any explanation why this wouldn't work?
>
I think 'Mike' was just saying that he does not know if it will work on
windows. I've applied this strategy on my site (apache2/gnu/linux) and
it works great. I do not see any reason it would not work on windows.
Can any one confirm this with a real test?
Michael
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] blocking one address
Posted by Leif W <wa...@usa.net>.
> ----- Original Message -----
> From: Daniel Wilson
> To: users@httpd.apache.org
> Sent: Friday, August 29, 2003 9:58 AM
> Subject: Re: [users@httpd] blocking one address
>
> When you say, "isn't a windoze web server", do you mean that I should
> not use this patch? if I am using a quote windoze web Server. (Currently
> I have Win XP running Apache2 (2..0.47)).
I don't see what difference it would make, as it's a simple Redirect or
RedirectMatch, which works just as well in Apache for windows as other OSes.
Anyone have any explanation why this wouldn't work?
Leif
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] blocking one address
Posted by Mike <mi...@levrah.net>.
At 08:58 AM 8/29/2003, you wrote:
>Hello
>
>When you say, "isn't a windoze web server", do you mean that I should not
>use this patch? if I am using a quote windoze web Server. (Currently I
>have Win XP running Apache2 (2..0.47)).
>
>Thanks
>Dan
It's probably better said "unless you're using those files / extensions /
paths being redirected, whether IIS or otherwise.
-mike
<snipped>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] blocking one address
Posted by Daniel Wilson <dw...@bayes1.com>.
Hello
When you say, "isn't a windoze web server", do you mean that I should not
use this patch? if I am using a quote windoze web Server. (Currently I
have Win XP running Apache2 (2..0.47)).
Thanks
Dan
At 08:10 PM 8/28/2003 -0500, you wrote:
>At 07:40 PM 8/28/2003, you wrote:
>>How can I block requests from a certain ip in Apache? There is some
>>virus (I think) bombarding me with requests for many different things.
>>Some examples (cut times to avoid wrapping, but this group was all within
>>about 2 secs):
>>
>>68.52.102.47 "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 404 -
>>68.52.102.47 "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 404 -
>>68.52.102.47 "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 404 -
>>68.52.102.47 "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 404 -
>>68.52.102.47 "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 400 226
>>68.52.102.47 "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 400 226
>>68.52.102.47 "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 404 -
>>68.52.102.47 "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 404 -
>>
>>
>>Luckily I'm not running NT. I suppose a better idea would be to block
>>this address from iptables. Any hints on how to do either of these things?
>>
>>Another question: I get the /default.ida (Code Red II virus) requests a
>>lot but from far too many different ips to making blocking the addresses
>>a solution. I was returning my 404 page at about 250 bytes each time so
>>I just made a 0 length default.ida, not 0 bytes get returned. However I
>>can't do that in this case, anyway to tell apache to return 0 bytes when
>>somethings looks for, say, the /scripts dir (which I don't have/need).
>>
>>TIA
>>Michael
>
>Mike.
>
>You're seeing code red and/or nimba (from ages ago) hits from machines
>that are *still* infected.
>
>To deal with these things, I have the following in my httpd.conf:
>
># Redirect Code Red, NIMDA and other inappropriate access attempts to
>invalid URL
>Redirect /_mem_bin http://www.request.invalid
>Redirect /_vti_bin http://www.request.invalid
>Redirect /c http://www.request.invalid
>Redirect /d http://www.request.invalid
>Redirect /msadc http://www.request.invalid
>Redirect /MSADC http://www.request.invalid
>Redirect /scripts http://www.request.invalid
>Redirect /sumthin http://www.request.invalid
>RedirectMatch ^.*\.(dll|ida)*$ http://127.0.0.1/$1
>RedirectMatch (.*)\cmd.exe$ http://127.0.0.1/$1
>
>Put those in your httpd.conf file (assuming you have access to your box
>and assuming the machine isn't a windoze web server) and then restart apache.
>
>HTH.
>-mike
>
>---------------------------------------------------------------------
>The official User-To-User support forum of the Apache HTTP Server Project.
>See <URL:http://httpd.apache.org/userslist.html> for more info.
>To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
>For additional commands, e-mail: users-help@httpd.apache.org
Daniel Wilson
Bayesian Edge Technology & Solutions
17260 Gum Landing Road
St. Inigoes Maryland 20684
(301)-872-0230 Phone
(301)-872-0233 Fax
www.bayesianedge.com
RE: [users@httpd] blocking one address
Posted by Dennis Foreman <df...@STNY.RR.COM>.
Do you have a solution for windoze servers?
regards,
D. J.
-----Original Message-----
From: Mike [mailto:mike.lists@levrah.net]
Sent: Thursday, August 28, 2003 9:52 PM
To: users@httpd.apache.org
Subject: Re: [users@httpd] blocking one address
At 08:41 PM 8/28/2003, you wrote:
>At 08:10 PM 8.28.2003 -0500, Mike wrote:
> >At 07:40 PM 8/28/2003, you wrote:
> >>How can I block requests from a certain ip in Apache? There is some
virus
> >>(I think) bombarding me with requests for many different things.
> >>Some examples (cut times to avoid wrapping, but this group was all
within
> >>about 2 secs):
> >>
> >>68.52.102.47 "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 404 -
> >>68.52.102.47 "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 404 -
> >>68.52.102.47 "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 404 -
> >>68.52.102.47 "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 404 -
> >>68.52.102.47 "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 400 226
> >>68.52.102.47 "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 400 226
> >>68.52.102.47 "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 404 -
> >>68.52.102.47 "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 404 -
> >>
> >>
> >>Luckily I'm not running NT. I suppose a better idea would be to block
> >>this address from iptables. Any hints on how to do either of these
things?
> >>
> >>Another question: I get the /default.ida (Code Red II virus) requests a
> >>lot but from far too many different ips to making blocking the addresses
a
> >>solution. I was returning my 404 page at about 250 bytes each time so I
> >>just made a 0 length default.ida, not 0 bytes get returned. However I
> >>can't do that in this case, anyway to tell apache to return 0 bytes when
> >>somethings looks for, say, the /scripts dir (which I don't have/need).
> >>
> >>TIA
> >>Michael
> >
> >Mike.
> >
> >You're seeing code red and/or nimba (from ages ago) hits from machines
that
> >are *still* infected.
> >
> >To deal with these things, I have the following in my httpd.conf:
> >
> ># Redirect Code Red, NIMDA and other inappropriate access attempts to
> >invalid URL
> >Redirect /_mem_bin http://www.request.invalid
> >Redirect /_vti_bin http://www.request.invalid
> >Redirect /c http://www.request.invalid
> >Redirect /d http://www.request.invalid
> >Redirect /msadc http://www.request.invalid
> >Redirect /MSADC http://www.request.invalid
> >Redirect /scripts http://www.request.invalid
> >Redirect /sumthin http://www.request.invalid
> >RedirectMatch ^.*\.(dll|ida)*$ http://127.0.0.1/$1
> >RedirectMatch (.*)\cmd.exe$ http://127.0.0.1/$1
> >
> >Put those in your httpd.conf file (assuming you have access to your box
and
> >assuming the machine isn't a windoze web server) and then restart apache.
> >
> >HTH.
> >-mike
> >
>
>Very interesting tip! Exactly where do you place those redirects in the
>httpd.conf, especially if there are vhosts in the httpd.conf...? Or, are
>they global...?
>
>I like the looks of this....
>
>Best regards,
>Jack L. Stone,
>Administrator
Jack.
I have vhosts defined in mine too. Those redirects are above the vhost
definitions.
HTH
-mike
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] blocking one address
Posted by Mike <mi...@levrah.net>.
At 08:41 PM 8/28/2003, you wrote:
>At 08:10 PM 8.28.2003 -0500, Mike wrote:
> >At 07:40 PM 8/28/2003, you wrote:
> >>How can I block requests from a certain ip in Apache? There is some virus
> >>(I think) bombarding me with requests for many different things.
> >>Some examples (cut times to avoid wrapping, but this group was all within
> >>about 2 secs):
> >>
> >>68.52.102.47 "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 404 -
> >>68.52.102.47 "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 404 -
> >>68.52.102.47 "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 404 -
> >>68.52.102.47 "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 404 -
> >>68.52.102.47 "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 400 226
> >>68.52.102.47 "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 400 226
> >>68.52.102.47 "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 404 -
> >>68.52.102.47 "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir
> >>HTTP/1.0" 404 -
> >>
> >>
> >>Luckily I'm not running NT. I suppose a better idea would be to block
> >>this address from iptables. Any hints on how to do either of these things?
> >>
> >>Another question: I get the /default.ida (Code Red II virus) requests a
> >>lot but from far too many different ips to making blocking the addresses a
> >>solution. I was returning my 404 page at about 250 bytes each time so I
> >>just made a 0 length default.ida, not 0 bytes get returned. However I
> >>can't do that in this case, anyway to tell apache to return 0 bytes when
> >>somethings looks for, say, the /scripts dir (which I don't have/need).
> >>
> >>TIA
> >>Michael
> >
> >Mike.
> >
> >You're seeing code red and/or nimba (from ages ago) hits from machines that
> >are *still* infected.
> >
> >To deal with these things, I have the following in my httpd.conf:
> >
> ># Redirect Code Red, NIMDA and other inappropriate access attempts to
> >invalid URL
> >Redirect /_mem_bin http://www.request.invalid
> >Redirect /_vti_bin http://www.request.invalid
> >Redirect /c http://www.request.invalid
> >Redirect /d http://www.request.invalid
> >Redirect /msadc http://www.request.invalid
> >Redirect /MSADC http://www.request.invalid
> >Redirect /scripts http://www.request.invalid
> >Redirect /sumthin http://www.request.invalid
> >RedirectMatch ^.*\.(dll|ida)*$ http://127.0.0.1/$1
> >RedirectMatch (.*)\cmd.exe$ http://127.0.0.1/$1
> >
> >Put those in your httpd.conf file (assuming you have access to your box and
> >assuming the machine isn't a windoze web server) and then restart apache.
> >
> >HTH.
> >-mike
> >
>
>Very interesting tip! Exactly where do you place those redirects in the
>httpd.conf, especially if there are vhosts in the httpd.conf...? Or, are
>they global...?
>
>I like the looks of this....
>
>Best regards,
>Jack L. Stone,
>Administrator
Jack.
I have vhosts defined in mine too. Those redirects are above the vhost
definitions.
HTH
-mike
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] blocking one address
Posted by "Jack L. Stone" <ja...@sage-one.net>.
At 08:10 PM 8.28.2003 -0500, Mike wrote:
>At 07:40 PM 8/28/2003, you wrote:
>>How can I block requests from a certain ip in Apache? There is some virus
>>(I think) bombarding me with requests for many different things.
>>Some examples (cut times to avoid wrapping, but this group was all within
>>about 2 secs):
>>
>>68.52.102.47 "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 404 -
>>68.52.102.47 "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 404 -
>>68.52.102.47 "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 404 -
>>68.52.102.47 "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 404 -
>>68.52.102.47 "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 400 226
>>68.52.102.47 "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 400 226
>>68.52.102.47 "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 404 -
>>68.52.102.47 "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir
>>HTTP/1.0" 404 -
>>
>>
>>Luckily I'm not running NT. I suppose a better idea would be to block
>>this address from iptables. Any hints on how to do either of these things?
>>
>>Another question: I get the /default.ida (Code Red II virus) requests a
>>lot but from far too many different ips to making blocking the addresses a
>>solution. I was returning my 404 page at about 250 bytes each time so I
>>just made a 0 length default.ida, not 0 bytes get returned. However I
>>can't do that in this case, anyway to tell apache to return 0 bytes when
>>somethings looks for, say, the /scripts dir (which I don't have/need).
>>
>>TIA
>>Michael
>
>Mike.
>
>You're seeing code red and/or nimba (from ages ago) hits from machines that
>are *still* infected.
>
>To deal with these things, I have the following in my httpd.conf:
>
># Redirect Code Red, NIMDA and other inappropriate access attempts to
>invalid URL
>Redirect /_mem_bin http://www.request.invalid
>Redirect /_vti_bin http://www.request.invalid
>Redirect /c http://www.request.invalid
>Redirect /d http://www.request.invalid
>Redirect /msadc http://www.request.invalid
>Redirect /MSADC http://www.request.invalid
>Redirect /scripts http://www.request.invalid
>Redirect /sumthin http://www.request.invalid
>RedirectMatch ^.*\.(dll|ida)*$ http://127.0.0.1/$1
>RedirectMatch (.*)\cmd.exe$ http://127.0.0.1/$1
>
>Put those in your httpd.conf file (assuming you have access to your box and
>assuming the machine isn't a windoze web server) and then restart apache.
>
>HTH.
>-mike
>
Very interesting tip! Exactly where do you place those redirects in the
httpd.conf, especially if there are vhosts in the httpd.conf...? Or, are
they global...?
I like the looks of this....
Best regards,
Jack L. Stone,
Administrator
SageOne Net
http://www.sage-one.net
jackstone@sage-one.net
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] blocking one address
Posted by Brian Dessent <br...@dessent.net>.
mgarriss wrote:
>
> How can I block requests from a certain ip in Apache? There is some
> virus (I think) bombarding me with requests for many different things.
> Some examples (cut times to avoid wrapping, but this group was all
> within about 2 secs):
I can understand the sentiment but I think you're going to find yourself
playing whack-a-mole by trying to deny anyone that sends you a
Nimda/Code Red probe. Even if you use the "Deny from <addr>" keyword in
httpd.conf or .htaccess, you'll still send a "403 Forbidden" error page
that's essentially the exact same thing as the "404 Not Found" or "400
Bad Request" page that you're sending now. It's really not hurting
anything, so I would just ignore it.
The only way to really make it go away is to add those addresses one by
one to your firewall deny rules, but it's a game of futility... you
would have to constantly watch your log files and note the IP addresses
add them each to the firewall after they've probed you... I could hardly
imagine them accounting for any significant percentage of bandwidth or
CPU usage, unless you're running a site on an ISDN line or something.
Brian
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] blocking one address
Posted by mgarriss <mg...@earthlink.net>.
mgarriss wrote:
> Seems that C++ is easier then english for me, let me try again:
>
> Another question: I get the /default.ida (Code Red II virus) requests
> a lot but from far too many different ips to making blocking the
> addresses a solution. I was returning my 404 page at about 250 bytes
> each time so I just made a 0 length default.ida, *now* 0 bytes get
> returned. However I can't do that in this case. *Any way* to tell
> apache to return 0 bytes when somethings looks for, say, the /scripts
> dir (which I don't have/need)?
Ugh. ignore that, i sent it a few hours ago and it just now showed up.
my questions have been answered, thank you Mike.
Michael
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] blocking one address
Posted by mgarriss <mg...@earthlink.net>.
mgarriss wrote:
> Another question: I get the /default.ida (Code Red II virus) requests
> a lot but from far too many different ips to making blocking the
> addresses a solution. I was returning my 404 page at about 250 bytes
> each time so I just made a 0 length default.ida, not 0 bytes get
> returned. However I can't do that in this case, anyway to tell apache
> to return 0 bytes when somethings looks for, say, the /scripts dir
> (which I don't have/need).
Seems that C++ is easier then english for me, let me try again:
Another question: I get the /default.ida (Code Red II virus) requests a
lot but from far too many different ips to making blocking the addresses
a solution. I was returning my 404 page at about 250 bytes each time so
I just made a 0 length default.ida, *now* 0 bytes get returned. However
I can't do that in this case. *Any way* to tell apache to return 0
bytes when somethings looks for, say, the /scripts dir (which I don't
have/need)?
Michael
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] blocking one address
Posted by cc <cc...@belfordhk.com>.
Mike wrote:
> # Redirect Code Red, NIMDA and other inappropriate access attempts to
> invalid URL
> Redirect /_mem_bin http://www.request.invalid
> Redirect /_vti_bin http://www.request.invalid
> Redirect /c http://www.request.invalid
> Redirect /d http://www.request.invalid
> Redirect /msadc http://www.request.invalid
> Redirect /MSADC http://www.request.invalid
> Redirect /scripts http://www.request.invalid
> Redirect /sumthin http://www.request.invalid
> RedirectMatch ^.*\.(dll|ida)*$ http://127.0.0.1/$1
> RedirectMatch (.*)\cmd.exe$ http://127.0.0.1/$1
>
> Put those in your httpd.conf file (assuming you have access to your box
> and assuming the machine isn't a windoze web server) and then restart
> apache.
>
First post on this list, but I believe this suggestion is a
great one! I was thinking of using squid to proxy all
those, or some other app, but I guess this is even
better!
Btw, would these Redirects be logged as well?
Thanks Mike!
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] blocking one address
Posted by mgarriss <mg...@earthlink.net>.
Mike wrote:
> You're seeing code red and/or nimba (from ages ago) hits from machines
> that are *still* infected.
>
> To deal with these things, I have the following in my httpd.conf:
>
> # Redirect Code Red, NIMDA and other inappropriate access attempts to
> invalid URL
> Redirect /_mem_bin http://www.request.invalid
> Redirect /_vti_bin http://www.request.invalid
> Redirect /c http://www.request.invalid
> Redirect /d http://www.request.invalid
> Redirect /msadc http://www.request.invalid
> Redirect /MSADC http://www.request.invalid
> Redirect /scripts http://www.request.invalid
> Redirect /sumthin http://www.request.invalid
> RedirectMatch ^.*\.(dll|ida)*$ http://127.0.0.1/$1
> RedirectMatch (.*)\cmd.exe$ http://127.0.0.1/$1
>
> Put those in your httpd.conf file (assuming you have access to your
> box and assuming the machine isn't a windoze web server) and then
> restart apache.
Great tip!
I have noticed that ALL of these hits are from within either 68.52.*.*
or 68.166.*.* I think one is a comcast domain and the other is an
earthlink (covad) domain. It probably wouldn't be cool to block these,
oh well. I'll use the above.
One thought: I wonder what's a bigger CPU hit, Redirect or 404 (0 length)?
Michael
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] blocking one address
Posted by Mike <mi...@levrah.net>.
At 07:40 PM 8/28/2003, you wrote:
>How can I block requests from a certain ip in Apache? There is some virus
>(I think) bombarding me with requests for many different things.
>Some examples (cut times to avoid wrapping, but this group was all within
>about 2 secs):
>
>68.52.102.47 "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir
>HTTP/1.0" 404 -
>68.52.102.47 "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir
>HTTP/1.0" 404 -
>68.52.102.47 "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir
>HTTP/1.0" 404 -
>68.52.102.47 "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir
>HTTP/1.0" 404 -
>68.52.102.47 "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir
>HTTP/1.0" 400 226
>68.52.102.47 "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir
>HTTP/1.0" 400 226
>68.52.102.47 "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir
>HTTP/1.0" 404 -
>68.52.102.47 "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir
>HTTP/1.0" 404 -
>
>
>Luckily I'm not running NT. I suppose a better idea would be to block
>this address from iptables. Any hints on how to do either of these things?
>
>Another question: I get the /default.ida (Code Red II virus) requests a
>lot but from far too many different ips to making blocking the addresses a
>solution. I was returning my 404 page at about 250 bytes each time so I
>just made a 0 length default.ida, not 0 bytes get returned. However I
>can't do that in this case, anyway to tell apache to return 0 bytes when
>somethings looks for, say, the /scripts dir (which I don't have/need).
>
>TIA
>Michael
Mike.
You're seeing code red and/or nimba (from ages ago) hits from machines that
are *still* infected.
To deal with these things, I have the following in my httpd.conf:
# Redirect Code Red, NIMDA and other inappropriate access attempts to
invalid URL
Redirect /_mem_bin http://www.request.invalid
Redirect /_vti_bin http://www.request.invalid
Redirect /c http://www.request.invalid
Redirect /d http://www.request.invalid
Redirect /msadc http://www.request.invalid
Redirect /MSADC http://www.request.invalid
Redirect /scripts http://www.request.invalid
Redirect /sumthin http://www.request.invalid
RedirectMatch ^.*\.(dll|ida)*$ http://127.0.0.1/$1
RedirectMatch (.*)\cmd.exe$ http://127.0.0.1/$1
Put those in your httpd.conf file (assuming you have access to your box and
assuming the machine isn't a windoze web server) and then restart apache.
HTH.
-mike
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org