Welcome, Guest
Please Login or Register.
Lost Password?
Cracker question (1 viewing)
Post Reply

TOPIC: Cracker question

#14803
velvetpixel (User)
Posts: 154
graphgraph
Cracker question 2008/07/15 13:42  
Been seeing some weirdness in my access_log.

Is this a cracker poking me:
"OPTIONS * HTTP/1.1" 400 295 "-" "-"

What about these?
69.13.230.1 - - [15/Jul/2008:11:46:50 -0700] "GET http://www.google.com/ HTTP/1.0" 200 514 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
206.169.193.251 - - [15/Jul/2008:12:47:27 -0700] "GET http://www.mit.edu/ HTTP/1.1" 200 511 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)"

The 200 is the apache response code right?
So what are the 514 and 511 and 295 from the top one?
Virtualmin Pro 3.60, Webmin 1.42, CentOS 5.2
  The administrator has disabled public write access.
#14804
velvetpixel (User)
Posts: 154
graphgraph
Re:Cracker question 2008/07/15 13:46  
Also I saw this in my messages log yesterday:

Jul 14 07:49:10 vps named[7554]: client 38.229.0.10#52318: notify question section contains no SOA


38.229.0.10 in not an IP for any of my domains and I have no slave DNS.

Why is that message being logged?
Virtualmin Pro 3.60, Webmin 1.42, CentOS 5.2
  The administrator has disabled public write access.
#14805
andreychek (User)
Posts: 248
graphgraph
Re:Cracker question 2008/07/15 16:41  
Jul 14 07:49:10 vps named[7554]: client 38.229.0.10#52318: notify question section contains no SOA 38.229.0.10 in not an IP for any of my domains and I have no slave DNS.

That may be a query from a DNS survey, as seen in packet #5 here:

http://cr.yp.to/surveys/dns1.html

The Debian folks are marking it as an "ignore" in Logcheck:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=443869

I suspect you can do the same ;-)
-Eric
  The administrator has disabled public write access.
#14806
velvetpixel (User)
Posts: 154
graphgraph
Re:Cracker question 2008/07/15 17:01  
The Debian folks are marking it as an "ignore" in Logcheck:
I suspect you can do the same ;-)


How do I do that?
Virtualmin Pro 3.60, Webmin 1.42, CentOS 5.2
  The administrator has disabled public write access.
#14807
andreychek (User)
Posts: 248
graphgraph
Re:Cracker question 2008/07/15 17:05  
velvetpixel wrote:
Been seeing some weirdness in my access_log.

Is this a cracker poking me:
"OPTIONS * HTTP/1.1" 400 295 "-" "-"

What about these?
69.13.230.1 - - [15/Jul/2008:11:46:50 -0700] "GET http://www.google.com/ HTTP/1.0" 200 514 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
206.169.193.251 - - [15/Jul/2008:12:47:27 -0700] "GET http://www.mit.edu/ HTTP/1.1" 200 511 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)"

The 200 is the apache response code right?
So what are the 514 and 511 and 295 from the top one?


If a server gets less than 100 people/bots a day trying to break into it, I might question whether it's actually on the Internet :-)

You're right, the first number you see afterwards is the Apache response code, the second is the size of the response.

So why are there get requests for google and mit? I have no idea :-) You can telnet to port 80 on your own server and manually enter those GET requests, and you should end up seeing your main page on that server for some of them, and errors for others.

You can read about the "OPTIONS" one here in the Request-URI section:

http://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html

Long story short though, patch your system, keep your web apps up to date, and I don't think you have the slightest thing to be concerned about from the above :-)
-Eric
  The administrator has disabled public write access.
#14808
andreychek (User)
Posts: 248
graphgraph
Re:Cracker question 2008/07/15 17:14  
How do I do that?

Oh, I just meant that you could safely ignore it.

"Logcheck" is a tool that scans through server logs and emails the admin about anomalies. It at one point Logcheck raised a flag when seeing messages like the one you mentioned above, but has been configured to no longer bring attention to it.

In case you're interested, there's more info on Logcheck here:

http://logcheck.org/

Have a good one!
-Eric
  The administrator has disabled public write access.
#14809
Joe (Admin)
Posts: 3779
graph
Re:Cracker question 2008/07/15 17:21  
And the similar, but unrelated (I think), tool on Red Hat based systems is logwatch.
  The administrator has disabled public write access.
#14810
velvetpixel (User)
Posts: 154
graphgraph
Re:Cracker question 2008/07/15 17:23  
Thanks Eric! That helps me know what's going on :)

So far the only logchecking app I have is me :D
Virtualmin Pro 3.60, Webmin 1.42, CentOS 5.2
  The administrator has disabled public write access.
#14811
andreychek (User)
Posts: 248
graphgraph
Re:Cracker question 2008/07/15 17:40  
It's awesome that you review the logs, many folks don't bother anymore.

It can be hard to grok it all though, and you might benefit from some tools that help you determine what's important and not (and only bother you when they see something important!).

As Joe mentioned, Logwatch is used by default on RHEL/CentOS. Logcheck is kept pretty up to date for Debian-based systems (though I don't know what they use by default).

I've also begun to hear some good things about Splunk: http://www.splunk.com/

Splunk is not free as in speech, it is free as in beer if you have less than 500MB of logs a day.

There's also host-based intrusion detection systems, like OSSEC and rkhunter:

http://www.ossec.net/
http://rkhunter.sourceforge.net/

I guess where I'm going with all this is that it's really hard to keep up with the logs, know what's a hack attempt versus a legitimate connection, or just have time at all to browse them.

There's a number of excellent tools out there designed to help with exactly that though (the above is just a few examples!). I'd encourage you to keep trying to understand what all you're seeing. There's just too much though, you'll never be able to keep up with it, so at the same time I'd also encourage you to use automated tools to help you monitor the logs and keep the bad guys out.
-Eric
  The administrator has disabled public write access.
#14813
velvetpixel (User)
Posts: 154
graphgraph
Re:Cracker question 2008/07/15 18:35  
I will look into Logwatch and I checked out splunk which is pretty cool!

I actually like looking at the logs (although using a tool would make it easier) because it's like taking the pulse of my machine. I just got in the habit of doing it when setting up iptable rules for the first time to try my best to keep malicious people out.
Virtualmin Pro 3.60, Webmin 1.42, CentOS 5.2
  The administrator has disabled public write access.
Post Reply
get the latest posts directly to your desktop

Talk and Get Help

Support
Forums
Bugs and Issues

Get Virtualmin

OS Support
Buy Online
Download
Copyright 2005-2007 Virtualmin, Inc. All rights reserved.