Apache Error Codes reveal a little more than I'd like....

[George Gallen <gg...@slackinc.com>]

See the snipit below from my logs:

202.101.127.9 - - [02/Apr/2002:02:53:24 -0500] "HEAD /~tmp HTTP/1.1" 401 0
202.101.127.9 - - [02/Apr/2002:02:53:24 -0500] "HEAD /~test HTTP/1.1" 401 0
202.101.127.9 - - [02/Apr/2002:02:53:24 -0500] "HEAD /~root HTTP/1.1" 403 0
202.101.127.9 - - [02/Apr/2002:02:53:25 -0500] "HEAD /~named HTTP/1.1" 401 0
202.101.127.9 - - [02/Apr/2002:02:53:25 -0500] "HEAD /~lp HTTP/1.1" 403 0
202.101.127.9 - - [02/Apr/2002:02:53:25 -0500] "HEAD /~logs HTTP/1.1" 401 0
202.101.127.9 - - [02/Apr/2002:02:53:25 -0500] "HEAD /~log HTTP/1.1" 401 0
202.101.127.9 - - [02/Apr/2002:02:53:25 -0500] "HEAD /~guest HTTP/1.1" 401 0
202.101.127.9 - - [02/Apr/2002:02:53:26 -0500] "HEAD /~ftp HTTP/1.1" 403 0
202.101.127.9 - - [02/Apr/2002:02:53:26 -0500] "HEAD /~bin HTTP/1.1" 403 0
202.101.127.9 - - [02/Apr/2002:02:53:26 -0500] "HEAD /.passwd HTTP/1.1" 401
0
202.101.127.9 - - [02/Apr/2002:02:53:26 -0500] "HEAD /.htpasswd HTTP/1.1"
403 0
202.101.127.9 - - [02/Apr/2002:02:53:27 -0500] "HEAD /.htaccess HTTP/1.1"
403 0
202.101.127.9 - - [02/Apr/2002:02:53:27 -0500] "HEAD /.bash_history
HTTP/1.1" 401 0
202.101.127.9 - - [02/Apr/2002:02:53:27 -0500] "HEAD /.access HTTP/1.1" 401
0

Intresting that if the filename exists a 403 is returned, vs a 401 if the
file
does not exist, regardless that I have all directories password protected
and as
can be seen, no username or password was even sent.

And what exactly does /~ftp or /~bin reference? They are valid logins
in my /etc/passwd file, HOWEVER, they are NOT in my .htpasswd file.

I'm not on the current apache release, so these may have been
addressed/fixed.

Granted, nothing was compromised, except a little more knowlege was gained
about our system, more than I would have liked.

George