You are viewing a plain text version of this content. The canonical link for it is here.
Posted to modperl@perl.apache.org by Nick Tonkin <ni...@rlnt.net> on 2001/09/20 18:41:54 UTC
[Announce] MSIISProbes.pm v1.03
Hello,
thanks to patches from Brice D. Ruth and others, a new version of
MSIISProbes.pm is available at
http://www.tonkinresolutions.com/MSIISProbes.pm.tar.gz
Changes:
v1.03 Added code to get e-mail for the SOA of the host (Brice D. Ruth)
Cut the DNS Resolver's timeout to 20 seconds
v1.02 Moved the URL for info for each worm into PerlSetVar in httpd.conf
comments/flames welcome
--nick
~~~~~~~~~~~
Nick Tonkin
Re: [Announce] MSIISProbes.pm v1.03
Posted by Nick Tonkin <ni...@rlnt.net>.
Hi Jan,
I'm afraid that might just gum up the bandwidth even more than these
idiots (and our flame mail to them :) ...
thanks for the support, though!
~~~~~~~~~~~
Nick Tonkin
On Thu, 20 Sep 2001, Jan Jungnickel wrote:
> Hallo,
>
> >> thanks to patches from Brice D. Ruth and others, a new version of
> >> MSIISProbes.pm is available at
> >> http://www.tonkinresolutions.com/MSIISProbes.pm.tar.gz
> >>
> >> Changes:
> >> v1.03 Added code to get e-mail for the SOA of the host
> >> (Brice D. Ruth)
> >> Cut the DNS Resolver's timeout to 20 seconds
> >>
> >> v1.02 Moved the URL for info for each worm into PerlSetVar
> >> in httpd.conf
>
> If you like, you you add code to report infected Hosts to our
> Nimda-Database? You can find further informations on
> http://worm.jungnickel.com
> --
> Greetings, Jan Jungnickel
>
Re: [Announce] MSIISProbes.pm v1.03
Posted by Jan Jungnickel <ja...@jungnickel.com>.
Hallo,
>> thanks to patches from Brice D. Ruth and others, a new version of
>> MSIISProbes.pm is available at
>> http://www.tonkinresolutions.com/MSIISProbes.pm.tar.gz
>>
>> Changes:
>> v1.03 Added code to get e-mail for the SOA of the host
>> (Brice D. Ruth)
>> Cut the DNS Resolver's timeout to 20 seconds
>>
>> v1.02 Moved the URL for info for each worm into PerlSetVar
>> in httpd.conf
If you like, you you add code to report infected Hosts to our
Nimda-Database? You can find further informations on
http://worm.jungnickel.com
--
Greetings, Jan Jungnickel
Re: [Announce] MSIISProbes.pm v1.03
Posted by Paul DuBois <pa...@dubois.ws>.
>Hello,
>
>thanks to patches from Brice D. Ruth and others, a new version of
>MSIISProbes.pm is available at
>http://www.tonkinresolutions.com/MSIISProbes.pm.tar.gz
>
>Changes:
> v1.03 Added code to get e-mail for the SOA of the host
>(Brice D. Ruth)
> Cut the DNS Resolver's timeout to 20 seconds
>
> v1.02 Moved the URL for info for each worm into PerlSetVar
>in httpd.conf
>
>
>comments/flames welcome
No flames, I like it. Is there a way to send a request to the module
to have it generate a report on the contents of the cache?
>
>--nick
>
>
>~~~~~~~~~~~
>Nick Tonkin
Re: MSIISProbes.pm v1.03
Posted by DeWitt Clinton <de...@unto.net>.
On Fri, Sep 28, 2001 at 08:49:22AM -0700, Nick Tonkin wrote:
> Cache::FileCache defaults to using /tmp for the location of its
> cache; does the system have /tmp (not sure what Cache::FileCache does if
> there's no /tmp, hafta look at the code).
You can manually override the temp directory by setting the
'cache_root' option when instantiating the cache. If cache_root isn't
set, then File::Spec's tmpdir( ) routine will be called, which seems
to return a value on just about all the machines I've tested (judging
by the lack of temp directory bug reports).
Cheers,
-DeWitt
Re: MSIISProbes.pm v1.03
Posted by Mike Schienle <mg...@ivsoftware.com>.
On Friday, September 28, 2001, at 08:49 AM, Nick Tonkin wrote:
> On Fri, 28 Sep 2001, Ask Bjoern Hansen wrote:
>
>> On Thu, 20 Sep 2001, Mike Schienle wrote:
>>
>>>> thanks to patches from Brice D. Ruth and others, a new version of
>>>> MSIISProbes.pm is available at
>>>> http://www.tonkinresolutions.com/MSIISProbes.pm.tar.gz
>>>
>>> Hi all -
>>>
>>> Can anyone provide a couple hints on getting this going with Tenon's
>>> iTools on MacOS X? For Reuven's CodeRed, it was just a matter of
>>> putting
>>> CodeRed.pm in /Library/Perl and adding the following code to the
>>> iTools.conf file (equivalent to httpd.conf).
>> [...]
>>> Any suggestions are greatly appreciated.
>>
>> check the code and your system configuration for the location of
>> sendmail (or whatever the module uses to send mail).
>
> MSIISProbes.pm use Mail::Sendmail to send mail ...
>
> Cache::FileCache defaults to using /tmp for the location of its
> cache; does the system have /tmp (not sure what Cache::FileCache does if
> there's no /tmp, hafta look at the code).
There is indeed a /tmp for MacOS X. Also, someone else on the list has
been able to get it working without any problems, so it's probably
something peculiar to my situation. I'm going to upgrade to version 10.1
of MacOS X and try again later today.
Is there some kind of test file that can do a simple pass through and
see if everything is in place? I've run apachectl configtest and it was
happy. Also, any chance of adding MSIISProbes to CPAN?
Mike Schienle
Interactive Visuals, Inc.
http://www.ivsoftware.com
Re: MSIISProbes.pm v1.03
Posted by Nick Tonkin <ni...@rlnt.net>.
On Fri, 28 Sep 2001, Ask Bjoern Hansen wrote:
> On Thu, 20 Sep 2001, Mike Schienle wrote:
>
> > > thanks to patches from Brice D. Ruth and others, a new version of
> > > MSIISProbes.pm is available at
> > > http://www.tonkinresolutions.com/MSIISProbes.pm.tar.gz
> >
> > Hi all -
> >
> > Can anyone provide a couple hints on getting this going with Tenon's
> > iTools on MacOS X? For Reuven's CodeRed, it was just a matter of putting
> > CodeRed.pm in /Library/Perl and adding the following code to the
> > iTools.conf file (equivalent to httpd.conf).
> [...]
> > Any suggestions are greatly appreciated.
>
> check the code and your system configuration for the location of
> sendmail (or whatever the module uses to send mail).
MSIISProbes.pm use Mail::Sendmail to send mail ...
Cache::FileCache defaults to using /tmp for the location of its
cache; does the system have /tmp (not sure what Cache::FileCache does if
there's no /tmp, hafta look at the code).
- Nick
Re: MSIISProbes.pm v1.03
Posted by Ask Bjoern Hansen <as...@valueclick.com>.
On Thu, 20 Sep 2001, Mike Schienle wrote:
> > thanks to patches from Brice D. Ruth and others, a new version of
> > MSIISProbes.pm is available at
> > http://www.tonkinresolutions.com/MSIISProbes.pm.tar.gz
>
> Hi all -
>
> Can anyone provide a couple hints on getting this going with Tenon's
> iTools on MacOS X? For Reuven's CodeRed, it was just a matter of putting
> CodeRed.pm in /Library/Perl and adding the following code to the
> iTools.conf file (equivalent to httpd.conf).
[...]
> Any suggestions are greatly appreciated.
check the code and your system configuration for the location of
sendmail (or whatever the module uses to send mail).
- ask
--
ask bjoern hansen, http://ask.netcetera.dk/ !try; do();
more than a billion impressions per week, http://valueclick.com
Re: MSIISProbes.pm v1.03
Posted by Mike Schienle <mg...@ivsoftware.com>.
On Thursday, September 20, 2001, at 09:41 AM, Nick Tonkin wrote:
>
> Hello,
>
> thanks to patches from Brice D. Ruth and others, a new version of
> MSIISProbes.pm is available at
> http://www.tonkinresolutions.com/MSIISProbes.pm.tar.gz
Hi all -
Can anyone provide a couple hints on getting this going with Tenon's
iTools on MacOS X? For Reuven's CodeRed, it was just a matter of putting
CodeRed.pm in /Library/Perl and adding the following code to the
iTools.conf file (equivalent to httpd.conf).
# added 08/06/01
PerlModule CodeRed
<Location /default.ida>
SetHandler perl-script
PerlHandler CodeRed
</Location>
I've since commented out the above lines. I've added MSIISProbes.pm to
/Library/Perl and also tried it at /Library/Perl/Apache, with no effect.
I restarted Apache after each change of code and/or location. There
doesn't appear to be any output (nothing relevant in the logs and no
email).
# added 09/20/01
<Location /default.ida>
SetHandler perl-script
PerlHandler Apache::MSIISProbes
PerlSetVar worm_name CodeRed
PerlSetVar worm_url
http://www.microsoft.com/technet/itsolutions/security/topics/codealrt.asp
</Location>
RewriteCond %{REQUEST_URI} !nimda
RewriteCond %{QUERY_STRING} /c.dir
RewriteRule .* /nimda? [R,L]
<LocationMatch /nimda*>
SetHandler perl-script
PerlHandler NPT::MSIISProbes
PerlSetVar worm_name Nimda
PerlSetVar worm_url
http://www.microsoft.com/technet/security/topics/Nimda.asp
</LocationMatch>
Any suggestions are greatly appreciated.
Mike Schienle
Interactive Visuals, Inc.
http://www.ivsoftware.com