Fingerprinting Port 80 Attacks: (via SlashDot) - Useful Info about common attacks on webservers
From the SlashDot Thread here's a way to separately log silly cmd.exe and root.exe attacks.
Partial solution for log trash (Score:5, Informative)
by wytcld on Monday November 05, @06:03PM (#2525102)
(User #179112 Info | http://slashdot.org/)
Here's how to get part way there (in this case for Nimda). In httpd.conf:
SetEnvIf Request_URI "cmd.exe" ATTACK
SetEnvIf Request_URI "root.exe" ATTACK
CustomLog /www/logs/access_log common env=!ATTACK
CustomLog /www/logs/attack_log common env=ATTACK
Order Allow,Deny
Allow from all
Deny from env=ATTACK
ErrorDocument 403 "
And then optionally for individual bad directories:
Deny from all
ErrorDocument 403 "
At this point requests for cgi.exe are not being logged in access_log
but only attack_log (leave out the attack_log line if you don't want
even that much). They'll still show in error_log (but with a shorter
error statement). The ErrorDocument line instructs Apache to send back
nothing and just drop the connection - not as nasty as a tar pit, but
at least you don't waste outgoing bandwidth, generally tighter than
incoming for a Webserver. Also, Apache doesn't waste any time checking
the file system on these requests, since the rules preclude that.
9:21:04 AM 
|
