You are viewing a plain text version of this content. The canonical link for it is here.
Posted to embperl@perl.apache.org by Neil Gunton <ne...@nilspace.com> on 2001/05/14 16:56:57 UTC
Curious log entries
I was concerned when I saw these entries in my apache error log:
[Sun May 13 12:05:09 2001] [error] [client 38.28.207.49] File does not exist: /www/crazyguyonabike/com/htdocs/_vti_bin/shtml.exe/_vti_rpc
(offline mode: enter name=value pairs on standard input)
What's this offline mode stuff? Is that embperl? The file requested has nothing to do with my system, so I can understand it not being found.
But the offline message unnerved me.
And here are the apache access log entries from around the same time:
38.28.207.49 - - [13/May/2001:12:05:04 -0400] "OPTIONS /community/boards/post HTTP/1.1" 301 362
38.28.207.49 - - [13/May/2001:12:05:06 -0400] "GET /_vti_inf.html HTTP/1.1" 301 2625
38.28.207.49 - - [13/May/2001:12:05:09 -0400] "POST /_vti_bin/shtml.exe/_vti_rpc HTTP/1.1" 301 2625
38.28.207.49 - - [13/May/2001:12:05:11 -0400] "OPTIONS /community/boards/post/?pics=small&tour_id=27&board_id=120&command=add HTTP/1.1" 200 4713
38.28.207.49 - - [13/May/2001:12:05:12 -0400] "GET /community/boards/post/?pics=small&tour_id=27&board_id=120&command=add HTTP/1.1" 200 4713
I have to admit, I have never seen an HTTP command named "OPTIONS".
The weird thing is, these entries do seem to correspond to a real message which has been posted on my message board.
Has anyone else seen this kind of thing?
Any clues on whether I should be worried? Tripwire didn't pick up any intrusion, but I am still curious,
both about that "offline mode" thing and the OPTIONS command.
TIA
-Neil
---------------------------------------------------------------------
To unsubscribe, e-mail: embperl-unsubscribe@perl.apache.org
For additional commands, e-mail: embperl-help@perl.apache.org
Re: OT: favicon.ico
Posted by Neil Gunton <ne...@nilspace.com>.
___cliff rayman___ wrote:
>
> instead of putting the icon in each directory, try these rewrite rules:
>
> RewriteCond %REQUEST_FILENAME !/my_icons/favicon.ico$
> RewriteRule favicon.ico$ /my_icons/favicon.ico
Hmmm, thanks a lot! I'll try that.
-Neil
---------------------------------------------------------------------
To unsubscribe, e-mail: embperl-unsubscribe@perl.apache.org
For additional commands, e-mail: embperl-help@perl.apache.org
OT: favicon.ico
Posted by ___cliff rayman___ <cl...@genwax.com>.
instead of putting the icon in each directory, try these rewrite rules:
RewriteCond %REQUEST_FILENAME !/my_icons/favicon.ico$
RewriteRule favicon.ico$ /my_icons/favicon.ico
Neil Gunton wrote:
> Just as I'd gotten rid of all those irritating error log entries related
> to favicon.ico (I finally downloaded a free icon generator and made an
> icon which I put in every directory on my server)...
--
___cliff rayman___cliff@genwax.com___http://www.genwax.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: embperl-unsubscribe@perl.apache.org
For additional commands, e-mail: embperl-help@perl.apache.org
Re: Curious log entries
Posted by Neil Gunton <ne...@nilspace.com>.
> I guess this location ( the root of your web) is served by Embperl, isn't it
> ? If it is, it's actualy the CGI.pm inside of Embperl that gets triggered.
> The question is why ? Do you see an access to your web root with strange
> parameters in %fdat ?
I have the following code in my /init.html:
use CGI qw(:standard);
$cgi = new CGI;
The $cgi object is then used for cookie handling. I'm not so concerned
about all this now that I realize that this is not a hack, but rather
just some new software protocol. It's still annoying, though, because
the HTML forms on my site are very basic, so there shouldn't be any need
at all for webdav to get involved. The client software should be
sticking to standard HTTP if that's what is being presented by the
server, IMHO... the form has a simple POST method, and that's all the
client needs to use. Rather than have the client make tentative
requests, surely the header information that is provided by the server
should be used to tell the client what kind of server this is, and
whether the webdav protocol is being used...
I have heard of webdav, but never used it. It certainly sounds
interesting.
Thanks for the help, as always
-Neil
---------------------------------------------------------------------
To unsubscribe, e-mail: embperl-unsubscribe@perl.apache.org
For additional commands, e-mail: embperl-help@perl.apache.org
Re: Curious log entries
Posted by Gerald Richter <ri...@ecos.de>.
>
> Thanks Gerald, so this looks like yet another annoyance from Microsoft.
Oh, webdav is a cool thing, if you need write access to your webserver, for
example for maintaining the content of your website. Addtional to uploading
documents, you can also assign properties to every document. I use this here
for some Content Management systems. There is an Apache module mod_dav
(www.webdav.org) which is part of Apache 2.0 core distribution. I plan to
write some Perl backend for this, so more on this later...
> Just as I'd gotten rid of all those irritating error log entries related
> to favicon.ico (I finally downloaded a free icon generator and made an
> icon which I put in every directory on my server)...
>
> As for CGI.pm, maybe I should pass this on to the developers of that
> module.
>
Looks like this error
[Sun May 13 12:05:09 2001] [error] [client 38.28.207.49] File does not
exist: /www/crazyguyonabike/com/htdocs/_vti_bin/shtml.exe/_vti_rpc
(offline mode: enter name=value pairs on standard input)
is related to this log entry
38.28.207.49 - - [13/May/2001:12:05:09 -0400] "POST
/_vti_bin/shtml.exe/_vti_rpc HTTP/1.1" 301 2625
I guess this location ( the root of your web) is served by Embperl, isn't it
? If it is, it's actualy the CGI.pm inside of Embperl that gets triggered.
The question is why ? Do you see an access to your web root with strange
parameters in %fdat ?
Gerald
-------------------------------------------------------------
Gerald Richter ecos electronic communication services gmbh
Internetconnect * Webserver/-design/-datenbanken * Consulting
Post: Tulpenstrasse 5 D-55276 Dienheim b. Mainz
E-Mail: richter@ecos.de Voice: +49 6133 925131
WWW: http://www.ecos.de Fax: +49 6133 925152
-------------------------------------------------------------
---------------------------------------------------------------------
To unsubscribe, e-mail: embperl-unsubscribe@perl.apache.org
For additional commands, e-mail: embperl-help@perl.apache.org
Re: Curious log entries
Posted by Neil Gunton <ne...@nilspace.com>.
Gerald Richter wrote:
> I don't think there is much to worry about. I guess somebody has opend your
> page with MS Word. The only interesting thing for me, would be why CGI.pm
> think it's started form the command line
Thanks Gerald, so this looks like yet another annoyance from Microsoft.
Just as I'd gotten rid of all those irritating error log entries related
to favicon.ico (I finally downloaded a free icon generator and made an
icon which I put in every directory on my server)...
As for CGI.pm, maybe I should pass this on to the developers of that
module.
-Neil
---------------------------------------------------------------------
To unsubscribe, e-mail: embperl-unsubscribe@perl.apache.org
For additional commands, e-mail: embperl-help@perl.apache.org
Re: Curious log entries
Posted by Gerald Richter <ri...@ecos.de>.
> I was concerned when I saw these entries in my apache error log:
>
> [Sun May 13 12:05:09 2001] [error] [client 38.28.207.49] File does not
exist: /www/crazyguyonabike/com/htdocs/_vti_bin/shtml.exe/_vti_rpc
> (offline mode: enter name=value pairs on standard input)
>
This is from CGI.pm. CGI.pm issues this prompt when you start a script which
uses CGI.pm from the command line. So at this location a script is called
that uses CGI.pm (Embperl only uses CGI.pm when the Content-Type of the
request is multipart/formdata) and for whatever reason CGI.pm doesn't
realizeses that it is called from the http server.
> What's this offline mode stuff? Is that embperl? The file requested has
nothing to do with my system, so I can understand it not being found.
> But the offline message unnerved me.
> And here are the apache access log entries from around the same time:
>
> 38.28.207.49 - - [13/May/2001:12:05:04 -0400] "OPTIONS
/community/boards/post HTTP/1.1" 301 362
> 38.28.207.49 - - [13/May/2001:12:05:06 -0400] "GET /_vti_inf.html
HTTP/1.1" 301 2625
> 38.28.207.49 - - [13/May/2001:12:05:09 -0400] "POST
/_vti_bin/shtml.exe/_vti_rpc HTTP/1.1" 301 2625
> 38.28.207.49 - - [13/May/2001:12:05:11 -0400] "OPTIONS
/community/boards/post/?pics=small&tour_id=27&board_id=120&command=add
HTTP/1.1" 200 4713
> 38.28.207.49 - - [13/May/2001:12:05:12 -0400] "GET
/community/boards/post/?pics=small&tour_id=27&board_id=120&command=add
HTTP/1.1" 200 4713
>
Is is a typical sequence that shows up when you try to open a page with MS
Webfolders or MSWord 2000.
> I have to admit, I have never seen an HTTP command named "OPTIONS".
The OPTIONS gives information about what your webserver supports. In this
case MSxxx what's to know if you webserver supports webdav (a protocol for
writing on the webserver), since you doesn't seem to support it, it looks
for MS FrontPage Server extentions (everything starting with _vti_ if
FrontPage), after both isn't found it issuses a normal GET request.
> The weird thing is, these entries do seem to correspond to a real message
which has been posted on my message board.
> Has anyone else seen this kind of thing?
> Any clues on whether I should be worried? Tripwire didn't pick up any
intrusion, but I am still curious,
> both about that "offline mode" thing and the OPTIONS command.
>
I don't think there is much to worry about. I guess somebody has opend your
page with MS Word. The only interesting thing for me, would be why CGI.pm
think it's started form the command line
Gerald
-------------------------------------------------------------
Gerald Richter ecos electronic communication services gmbh
Internetconnect * Webserver/-design/-datenbanken * Consulting
Post: Tulpenstrasse 5 D-55276 Dienheim b. Mainz
E-Mail: richter@ecos.de Voice: +49 6133 925131
WWW: http://www.ecos.de Fax: +49 6133 925152
-------------------------------------------------------------
---------------------------------------------------------------------
To unsubscribe, e-mail: embperl-unsubscribe@perl.apache.org
For additional commands, e-mail: embperl-help@perl.apache.org