hacking possible

[pasin]

Hello everybody!

I have a sendmail server(with squirrelmail as web mail) and today Logwatch showed me this message:

/?-d%20allow_url_include%3DOn+-d%20auto_prepend_file%3D../../../../../../../../../../../../etc/passwd%00%20-n/?-d%20allow_url_include%3DOn+-d%20auto_prepend_file%3D../../../../../../../../../../../../etc/passwd%00%20-n HTTP Response 302

Should I worry about it?

[Roxoff]

This is a server probe - someone trying to access files that aren't secure in an attempt to gain information about your system that'll allow them access. There are several course of action you can take - probably the best is to install and configure ModSecurity for your apache server. You can also use Mod Rewrite to catch urls matching various odd formats.

The other thing you could do is extend logwatch to monitor your httpd error logs and php logs. I find this is particularly helpful.

You may want to take that URL and try it on your own site to see what page your apache install feeds you when you make the request. That'll give you peace of mind - it's likely to be an error page of some kind.

I think it'd be really nice to be able to intercept these kinds of hack attempts and use ModRewrite to hand them off to a page that just never responds, the caller will be sat waiting for the page to timeout. That'll slow down anyone trying to use this kind of attack to trawl lots of servers for the ones that aren't properly secure. But Apache won't let you provide no response - it has to reply with something.

[Kloschüssel]

I think it'd be really nice to be able to intercept these kinds of hack attempts and use ModRewrite to hand them off to a page that just never responds, the caller will be sat waiting for the page to timeout. That'll slow down anyone trying to use this kind of attack to trawl lots of servers for the ones that aren't properly secure. But Apache won't let you provide no response - it has to reply with something.

Generally it is not a good idea to leave connections open for someone that tries to gain access to your server. It opens doors to some very effective DOS attacks. Handling such cases by firewalling the requester for 15min is a much better solution. If you agree, take a look at fail2ban.